d132fcc0656ed420df20b4a28651bfd43c4a87bd8eedf9e99f28fcf5d25fbab6

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d132fcc0656ed420df20b4a28651bfd43c4a87bd8eedf9e99f28fcf5d25fbab6.exe
Size 1.8MB
Sample260506-ebwl5aes3j
SHA256 d132fcc0656ed420df20b4a28651bfd43c4a87bd8eedf9e99f28fcf5d25fbab6
MD5 76ef5d3be81555f7e14f94bb66f9a61f
SHA1 0374a65b92c5598435d11ba658ed0932718f7290
SHA512 ceeb0a2c83e2990fae3271ca1f2a5d8a6c19b7ca9eef0f1a00bdf1b23383d8ef2ff4ad3a7d3594845ba223042165821c192e608a3f7c7f733497197c747a564b
SSDEEP 49152:JFt1IWCZ4262STRuA2TVR84pWUcPp/P0l3yj+:XtKZ426LTq8fUac
TLSH
T18885BF02F781C1B3E89316B916BF577E5F39AA210319D5C3D7D01D664E213E1BA3A38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d132fcc0656ed420df20b4a28651bfd43c4a87bd8eedf9e99f28fcf5d25fbab6.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1064	d132fcc0656ed420df20b4a28651bfd43c4a87bd8eedf9e99f28fcf5d25fbab6.exe
1064	d132fcc0656ed420df20b4a28651bfd43c4a87bd8eedf9e99f28fcf5d25fbab6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	d132fcc0656ed420df20b4a28651bfd43c4a87bd8eedf9e99f28fcf5d25fbab6.exe

C:\Users\Admin\AppData\Local\Temp\d132fcc0656ed420df20b4a28651bfd43c4a87bd8eedf9e99f28fcf5d25fbab6.exe
"C:\Users\Admin\AppData\Local\Temp\d132fcc0656ed420df20b4a28651bfd43c4a87bd8eedf9e99f28fcf5d25fbab6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-0-0x0000000001600000-0x000000000164A000-memory.dmp

Download