dfe40cde6c7b5e0fad50949183dfdb9e9aca4f1d3ff64258a98011bd941ac445

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dfe40cde6c7b5e0fad50949183dfdb9e9aca4f1d3ff64258a98011bd941ac445.exe
Size 3.7MB
Sample260503-va5fmsdx91
SHA256 dfe40cde6c7b5e0fad50949183dfdb9e9aca4f1d3ff64258a98011bd941ac445
MD5 d8bd83986be52e4a7e3935d0074a86c3
SHA1 f3588a97e49e9ed68c914e729cd4adb1b4ed4d71
SHA512 d04480f4ea8cd913a55a12263eb44b02c9c1164b20fb61c684c9c99bff32202df6d1bc10e78865a1daee8dcc984ef0cb01c5d1c36c33a087eb46c3c0960d995c
SSDEEP 98304:kKGqahpEqcYBxvunCaN5EVNiqPGdj34opu:kN2IWnaGdj39M
TLSH
T1AB06C012FA8241B2D89A067549BB573F9F39EB104325CAC3D7A4FC796C311D1663E38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5300	dfe40cde6c7b5e0fad50949183dfdb9e9aca4f1d3ff64258a98011bd941ac445.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfe40cde6c7b5e0fad50949183dfdb9e9aca4f1d3ff64258a98011bd941ac445.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5300	dfe40cde6c7b5e0fad50949183dfdb9e9aca4f1d3ff64258a98011bd941ac445.exe
5300	dfe40cde6c7b5e0fad50949183dfdb9e9aca4f1d3ff64258a98011bd941ac445.exe

C:\Users\Admin\AppData\Local\Temp\dfe40cde6c7b5e0fad50949183dfdb9e9aca4f1d3ff64258a98011bd941ac445.exe
"C:\Users\Admin\AppData\Local\Temp\dfe40cde6c7b5e0fad50949183dfdb9e9aca4f1d3ff64258a98011bd941ac445.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HPSocket4C.dll

Path C:\Users\Admin\AppData\Local\Temp\HPSocket4C.dll
Size 2.8MB
SHA256 dc4936ca53cd4a2ef1fc3c4bafc53391afd434c6d9b2eb9ab6c527a32ee7b5f4
MD5 0d876831e50bdbe4ce2c4999dbfebaff
SHA1 207dfbc239789c98e50ac2d4d7cd94c2ab8569a4
SHA512 df16aeadd39233f92d250581db48037aa55c836a34478018e38b37a47a618f1a32cf3fde8c1adadafac19d02e276c0d43f53216b2dc11f04fa24b4ebe15addd4
SSDEEP 49152:FA35k5lakvuRqyLNYLmN5YdecN8oZoqPGZfvLop84oACuSefM:FBxvunCaN5EVNiqPGdj34opu
TLSH
T118D5C002FB8281B1D89E017945BB577F5E39EB204315CAC3ABA47C786D611D26B3D38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5300-5-0x0000000000EA0000-0x0000000000F5F000-memory.dmp

Download