c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe
Size 15.0MB
Sample260508-1ephwaev8t
SHA256 c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d
MD5 0a3dd99e5b74174dc69fcf8e1eeb559f
SHA1 3a6c3b8d752e5ffc447bf4ef4237460786f759c2
SHA512 83aaef485125c5565f0be517f29e6f713560b8353f50829c6070f4965bcefd4389958c6cb652fe6633b30d7425e1d32f8252958a5654059e8bc7b772be03b19a
SSDEEP 196608:PsiGQlDxZF6gAf0Cvr0YWkYjQ5y0bU9zqpfZ/EOvv9ntkg0dgFCYnHSbFLTk7Qo:PsiXlVek0B5yBuB/l9n8gRyZO
TLSH
T1D4F6332378E29437EB6644F00DC92B09AFF9EA6315348C8B53D57D0876B4E82D329767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
912	sg.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3408	c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe
3408	c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeBackupPrivilege	3408	c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe
Token: SeRestorePrivilege	3408	c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe
Token: 33	3408	c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe
Token: SeIncBasePriorityPrivilege	3408	c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe
Token: SeCreateGlobalPrivilege	3408	c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe
Token: 33	3408	c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe
Token: SeIncBasePriorityPrivilege	3408	c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe
Token: 33	3408	c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe
Token: SeIncBasePriorityPrivilege	3408	c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe
Token: SeRestorePrivilege	912	sg.tmp
Token: 35	912	sg.tmp
Token: SeSecurityPrivilege	912	sg.tmp
Token: SeSecurityPrivilege	912	sg.tmp
Token: SeDebugPrivilege	3408	c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 3748	3408	c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe	80
PID 3408 wrote to memory of 912	3408	c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe	82

C:\Users\Admin\AppData\Local\Temp\c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe
"C:\Users\Admin\AppData\Local\Temp\c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:3748
- C:\Users\Admin\AppData\Local\Temp\~3057348635958538451~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\c03588ae23d3308650f6ba9df4c0b93db7615858fb0c4251c26381743b50922d.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~8368530070765561046"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sg.tmp

Path C:\Users\Admin\AppData\Local\Temp\~3057348635958538451~\sg.tmp
Size 827KB
SHA256 989f4d4da1c2a68ec4f6ccf8fbe9e1c9dc7342ef6fe50b3ab8794fdaa76f09ac
MD5 cdc6bdc1e8fe3f1b767b81337ffbc99a
SHA1 dde4aae203b273bf39c0442d97bb9acc027e231d
SHA512 777b236fd6768779c3cc799667f706289712239dc74f1be8cde44f9c09b6958c38e6e1bb6440f8b195583b21cfe36376f90142e8161c4e9b9769d307bc37663d
SSDEEP 24576:W9npvGj0nOTKzik231Ct6MzzPNpk+qkMMCD4H2:WN5GAnO+E0t/vseyr
TLSH
T16F059E127BE5D077C2421131DB1C7BF691FA93680B2148C7A3908F6D7B359D2DA3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3408-0-0x0000000000400000-0x0000000000586000-memory.dmp

Download

memory/3408-7-0x00000000004C0000-0x00000000004C1000-memory.dmp

Download

memory/3408-8-0x0000000000400000-0x0000000000586000-memory.dmp

Download

memory/3408-9-0x0000000000400000-0x0000000000586000-memory.dmp

Download