6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
07/05/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe
Size 10KB
Sample260507-pca2xsds41
SHA256 6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687
MD5 f3e913df14f4da32a99c1fb61ef06e7c
SHA1 24463d71b1d5a901759a7a0b7dda304a3163830d
SHA512 fca8da43f508b2d56347591acc09ef6b049533424d732fdec25af4a0acbc761b50694c4682e07295cc826d855ca0927820199521f9727c400e1c640f6271d844
SSDEEP 96:7BOdVoGYz/J4hvFDBWdCaD4DbFx+ZQnBpsTVwNYspKPFJxGE9mZ2FFhxC7tCEore:Vwo1wFDBFx+enfNKPFJxTEZmFhSor
TLSH
T1BD22FA197E4A4331D3A089F81875834B553D2663E783E3EFF373959A4A653484C41E6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 8 IoCs

flow	pid	Process
1	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe
6	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe
6	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe
6	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe
6	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe
6	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe
6	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe
6	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe

Executes dropped EXE 9 IoCs

pid	Process
4832	2382133728.exe
5028	4160512733.exe
4968	972724552.exe
4928	1952422695.exe
5088	1848032949.exe
4856	1484312326.exe
5272	3584024418.exe
3984	1842335593.exe
5540	1491215786.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1848032949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1484312326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1842335593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1491215786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1952422695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3584024418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2382133728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4160512733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	972724552.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 4832	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe	78
PID 1792 wrote to memory of 5028	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe	79
PID 1792 wrote to memory of 4968	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe	80
PID 1792 wrote to memory of 4928	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe	81
PID 1792 wrote to memory of 5088	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe	82
PID 1792 wrote to memory of 4856	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe	83
PID 1792 wrote to memory of 5272	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe	84
PID 1792 wrote to memory of 3984	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe	85
PID 1792 wrote to memory of 5540	1792	_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe	86

C:\Users\Admin\AppData\Local\Temp\_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe
"C:\Users\Admin\AppData\Local\Temp\_6d7b45d906a2e0acc89a332090112143a03dfdbacc9ab6ca52ed30f3c09aa687.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\2382133728.exe
  C:\Users\Admin\AppData\Local\Temp\2382133728.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4832
- C:\Users\Admin\AppData\Local\Temp\4160512733.exe
  C:\Users\Admin\AppData\Local\Temp\4160512733.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5028
- C:\Users\Admin\AppData\Local\Temp\972724552.exe
  C:\Users\Admin\AppData\Local\Temp\972724552.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4968
- C:\Users\Admin\AppData\Local\Temp\1952422695.exe
  C:\Users\Admin\AppData\Local\Temp\1952422695.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4928
- C:\Users\Admin\AppData\Local\Temp\1848032949.exe
  C:\Users\Admin\AppData\Local\Temp\1848032949.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5088
- C:\Users\Admin\AppData\Local\Temp\1484312326.exe
  C:\Users\Admin\AppData\Local\Temp\1484312326.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4856
- C:\Users\Admin\AppData\Local\Temp\3584024418.exe
  C:\Users\Admin\AppData\Local\Temp\3584024418.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5272
- C:\Users\Admin\AppData\Local\Temp\1842335593.exe
  C:\Users\Admin\AppData\Local\Temp\1842335593.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3984
- C:\Users\Admin\AppData\Local\Temp\1491215786.exe
  C:\Users\Admin\AppData\Local\Temp\1491215786.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1484312326.exe

Path C:\Users\Admin\AppData\Local\Temp\1484312326.exe
Size 19KB
SHA256 69c1077c17e91680304fcc397ded72824bc24161bffd8efca86c29ba9221d198
MD5 6c58fb4f988d797bceb6f1070973d028
SHA1 63eb33d403a3767171e4521c3df0afbe8f61cd2c
SHA512 ce0eeb6fb11925274f8f7a0ee37ba6eb632391b6b5df21c71504b12863d49db3d4f6b99a777d68fc069483db43dabc43da4eb76fce900912d8213bd83f05fad8
SSDEEP 384:BIkjrVlvaZLBDzB1wZov0lu9NH0rFZDTtav8U9cZG:tWL9Nfv0g9ea0UsG
TLSH
T18D924B0BBA548316D1D0007466A24B3FD67998B6338454EFFBD889CA1B682E6F83255F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1491215786.exe

Path C:\Users\Admin\AppData\Local\Temp\1491215786.exe
Size 19KB
SHA256 3badd58c276f867d0ce687a120956d6fa8810a12d14c7b6fe885c920230c9479
MD5 6da62ed35188e1d57e1057e358774259
SHA1 3772b529fff7d7dace92aa31c01ae635825cd8da
SHA512 adf499026ae0c810b6ec44fc781e95701bc53b2584feb3ba83bf8b367ac809bd0ff6ff82ac326c10b21a536d71597cea1f016f69072c9c5c6f677c0bc472828f
SSDEEP 384:/Ikj7VlvaZLRzjBVwFwSZlu9NH0rFZDTdav8U9cPG:PmLd9bUg9Oa0UKG
TLSH
T1EF925B0FBA544316D1D00474A6A6477FD6B98876338454EFFBC886CA1B682E6F83315F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1632521949.exe

Path C:\Users\Admin\AppData\Local\Temp\1632521949.exe
Size 11KB
SHA256 b62d1821823fc17341646f511efedee36cda12e8094936e89b28a91514b33fbc
MD5 deeb16e487013f8d8cffc06a17c13934
SHA1 970fab843d51e6c6456d4067f455dc198a5cfa19
SHA512 df98fb3be0f2787d8ce800cff87827c58a60c57ffaaacaedc850fe1200c3349aef5bc6a1ec5f50c811f04cf9f5a0d54d34018780fea901e163636c6bc2d020b2
SSDEEP 192:FY1SCngTBvkjLVlv/iZuSQvIj6AUaT5wtm3le611KUSvu9zwwHFQ:mIkjLVlvaZLhjTB1wtg0lu9NHy
TLSH
T1E342070FF9A0832AE1C140B496624B3FC97198B5338494D7E7E88ADA417CBE6F43640F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1842335593.exe

Path C:\Users\Admin\AppData\Local\Temp\1842335593.exe
Size 19KB
SHA256 5213397d4f4b2f411878d7e470be289df86746f8a414ad66945ad7dad6a170e3
MD5 fd44b787d1f619bcc3657eb34f28c9cc
SHA1 1fda7fefb20849ef8402ec55917a8e13fd12da89
SHA512 126baa3fe196535bacca12032fcdb681b94b07a4258fed6cc7ababa9f25a53d10e3cf51c04a290c54e8af6025db6ce26ef215605c7a4e0cc916597b22a813725
SSDEEP 384:UIkj7VlvaZLRzjBVwFwSZlu9NH0r4DDTdav8U9cVG:YmLd9bUg9Va0UwG
TLSH
T1A6925C0FBA548316D1D0047466A2877FD6B98876338454EFFBC886CA0B686E6F83315F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1848032949.exe

Path C:\Users\Admin\AppData\Local\Temp\1848032949.exe
Size 19KB
SHA256 ec523e453bc03e97c54c7510186c34f1b0a787ca16ff1b036c523efc64ec4ec4
MD5 36c9b7687a9c125c8a0f6a5c80062b0e
SHA1 9d24134df47b53d4cc00667808c3c5b32f5fb91c
SHA512 6603ca4ff71e5652e698cfcafa7a9a4848938a01472a446e9018f97a0e48b2a2412def8421dd80e8c6b29c5234af5bfec1c5159b4a641e9a80ca1e4832b49a65
SSDEEP 384:MIkj7VlvaZLRzjBVwRwSZlu9NH0rFZDTdav8U9cPG:wmLd9fUg9Oa0UuG
TLSH
T111925C0FBA544316D1D0047466A6477FD6B98876338454EFFBC886CA1B682E6F83315F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1952422695.exe

Path C:\Users\Admin\AppData\Local\Temp\1952422695.exe
Size 19KB
SHA256 f7bf3149d776cb837ffe394f2f30111d814f23049800b3355441f52c30da17a0
MD5 dfefbb63a94c52e06b1444041503dfd6
SHA1 497f516327f71f90c95b600a4daf34b839005038
SHA512 510c9702b14d01440e01ed1df0bd32a840077e6ea01ff143ad873043335b5c8ebd4a845a5ef456dad12e1cb8a8697261cc8c8a50844d45bc12ef2977ccdc1923
SSDEEP 384:UIkj7VlvaZLRzjBVwZwSZlu9NH0rFZDTdav8U9cFG:YmLd93Ug9Oa0UsG
TLSH
T12D925C0FBA548316D1D00474A6A6477FD6B98876338454EFFBC886CA1B682E6F83315F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2382133728.exe

Path C:\Users\Admin\AppData\Local\Temp\2382133728.exe
Size 19KB
SHA256 235e842f2b22ca59648111919a0df1a4fae1301d94ae818a3fe35bcb42d56cdc
MD5 e051956c888f4d41f17c89e88be96bb6
SHA1 30087c2865e58a18f622aa39d6d7c93ddcbba4c7
SHA512 c1c9948ae75d80170ecf1c9b8b80963ced8d03f86b1b3a3878bf0e00f969f50b836b65b58feb1da7b2376d12c40af5f07a82a2d96be7267213110d1dedebb5d7
SSDEEP 384:mIkjLVlvaZLhjTB1wtg0lu9NH0rFZDTNav8U9cnG:W2L9tD0g9+a0UuG
TLSH
T157925B0FFA948316D1C1047456A28B3FD6B99876338454EFF7C886CA1B682E6F83215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3584024418.exe

Path C:\Users\Admin\AppData\Local\Temp\3584024418.exe
Size 19KB
SHA256 b75c9acb2ca883c930191fb7f20422bd2ec48d029a58beec591f00318ce838ed
MD5 b7a68e1055593dbcf0cb10c873cf845b
SHA1 bf23648382b728944c8bc1bf6f87d98275bf0f6c
SHA512 c9b4f5d140fbbf3d213927f43a05e3c1465167e2f8650f236e82d2c6ed7c7cb46fc8340e978095d028e37b4969fd921c78a0076af7c3e9d68916748eae4bc2bc
SSDEEP 384:AIkjLVlvaZLhjTB1wtg0lu9NH0rjDDTNav8U9c0G:U2L9tD0g9+a0UJG
TLSH
T1E8925B0FFA948316D1C0047496A24B3FD5799876338454EFF7C886CA0B682E6F83215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4160512733.exe

Path C:\Users\Admin\AppData\Local\Temp\4160512733.exe
Size 19KB
SHA256 733f4abb59577e459509b7ac26c3c8d395ca2c3a8a9ed9f5f6c5a7eb4549b251
MD5 0ccbea8573c7ba4cba51e9ea139926bb
SHA1 2e8fd884b4319c0aebe938aea395f627fe68557a
SHA512 2218c11fb45799f2f85dbe41b189ab17b7fb0994b0769f3ddb98d76fc1ce8b18047b9768f5420c064ea7205267c538d05fe8fc0dc42a8d35f1a557124464ed4b
SSDEEP 384:eIkj7VlvaZLRzjBVwRwSZlu9NH0rFZDTdav8U9ctG:umLd9fUg9Oa0U8G
TLSH
T178925B0FBA548316D1D0047466A64B7FD6B98876338454EFFBC886CA1B682E6F83315F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

972724552.exe

Path C:\Users\Admin\AppData\Local\Temp\972724552.exe
Size 19KB
SHA256 ff4f9c8e990c7a1b48fc286c47c442cd4bf151e1f0323d3eb86af26a3c749414
MD5 cde12373a968cbb890166e33dfd48686
SHA1 b08f6699a3cfc33b09d79c0454d868d2ba0a28a0
SHA512 d904892eb35a5b7391febec939bafa63c53e3c18db6e36123748ed631b2d1c456dd962ffdfa7203d1f13186abb52e2321361402991362463641f0949cd138031
SSDEEP 384:RIkjLVlvaZLhjTB1wtg0lu9NH0rFZDTNav8U9cqG:92L9tD0g9+a0UDG
TLSH
T176925B0FFA908316D1D1047456A24B7FD6B99876338454EFF7C886CA0B682E6F83215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1792-0-0x0000000002F20000-0x0000000002FBC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads