06d6e4b054584d260e4fca1866649348976dcb9343aa79050cae57fec3788daf

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06d6e4b054584d260e4fca1866649348976dcb9343aa79050cae57fec3788daf.exe
Size 1.0MB
Sample260506-xpejwagy21
SHA256 06d6e4b054584d260e4fca1866649348976dcb9343aa79050cae57fec3788daf
MD5 361484948df44aaac94de78d2ae27533
SHA1 7c1bcfef43c5cb639ae0a85afc0f8f1909afd60a
SHA512 384b662e2f135bfcc938d0e48bb8e0951cf32cab98a6830626c08adb1ae99130fee8627653bcc61f17d4b57f9a68395ad68d3bb99de27bf4f7cd79870d0c0584
SSDEEP 24576:Z9R5kZ6HJ+uWRcZwJmSU/2ajjXhrp4w5a01Mnx:7kZl8SUdXpp4w5a08
TLSH
T1A035491273F58139F2B31B706D79A2645A7ABCB15831C61F33DC690D1B70A81EA26B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	06d6e4b054584d260e4fca1866649348976dcb9343aa79050cae57fec3788daf.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06d6e4b054584d260e4fca1866649348976dcb9343aa79050cae57fec3788daf.exe

C:\Users\Admin\AppData\Local\Temp\06d6e4b054584d260e4fca1866649348976dcb9343aa79050cae57fec3788daf.exe
"C:\Users\Admin\AppData\Local\Temp\06d6e4b054584d260e4fca1866649348976dcb9343aa79050cae57fec3788daf.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-0-0x0000000000DF0000-0x0000000000F01000-memory.dmp

Download