Analysis
- max time kernel
149s - max time network
129s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 18:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37.exe
Resource
win10v2004-20260130-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37.exe
Resource
win11-20260130-en
6 signatures
150 seconds
General
- Target 7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37.exe
- Size 152KB
- Sample260503-xd26ssfv81
- SHA256 7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37
- MD5 e4f4bf747c5012701095216bbe1b8caf
- SHA1 dcc455f6955ac96d4db2216fb8fba3c6e2189296
- SHA512 ccbd181421e5549e13a9960a31e03a1ddaf415f07050d9d5fbe96bd97ac1ebed9892aa7c1894ba08679942e293a233fa4a3074dd98c727185f6a8a580a2f689e
- SSDEEP 3072:tdqGyNeP182oX9GahCUAdlORoZKRXxDax+yG+N+OD:tdqH8Po8pH2Ros1WiUb
- TLSH T1C1E35B12B6D68470D1AE04740835DBB16B3FBC30DB609DAB27546FAD0D746C2AE7272B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1828 7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37.exe - Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1828 7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37.exe 1828 7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37.exe 1828 7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37.exe 1828 7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1828 7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37.exe 1828 7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37.exe 1828 7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37.exe 1828 7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1828 7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37.exe"C:\Users\Admin\AppData\Local\Temp\7441476b85f648ccbc4dd421eb4aacb2f1be2231b72462930fd7c94a5812bd37.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1828
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\ALD\SunCalculation.dll
- Size 100KB
- SHA256 a03d8488a2807b6f944c22c88f9722de3f6fbee7733fedd25e553c0e71edb047
- MD5 3d03e03277b0cbe5a6813788380eaabd
- SHA1 38ec610656580029c353b66a51e50d203bb482a8
- SHA512 8ea3c820892024e0fbdcac04590f7bc86d5b3c77be11abebc36ba350d32834c6fe08ac7831b8e0be023232f30be89f6c44173a1edf24e6ef7232886379a754f6
- SSDEEP 3072:D82oX9GahCUAdlORoZKRXxDax+yG+N+OD:5o8pH2Ros1WiUb
- TLSH T19FA35B00F5D2C8B1C4BE44791824DBB25B7F3860EFA0ACFB27540AAE4E781D1DE76956
- MD5 SHA1 SHA512 SSDEEP TLSH