Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/05/2026, 00:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed09400bb4c6c941020335923713f1454c6f5b9a1c8cf792bd69702aba0f223c.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ed09400bb4c6c941020335923713f1454c6f5b9a1c8cf792bd69702aba0f223c.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target ed09400bb4c6c941020335923713f1454c6f5b9a1c8cf792bd69702aba0f223c.exe
- Size 20KB
- Sample260509-athqrsgw21
- SHA256 ed09400bb4c6c941020335923713f1454c6f5b9a1c8cf792bd69702aba0f223c
- MD5 bca8090fe7504833fadea22b187dd73c
- SHA1 e9eafa3804f803e95f53d88dedc1f0afed85bc63
- SHA512 5ae90507509e8595d6e9e5d93fcdbb1f899ea61275d8b88fc1955504fe06dfc6307673a3025d46a23a6b3cd156866256af4de8d02b46918e81bfd81cbd69186e
- SSDEEP 384:ANk2Yqe2sQm4XgG/9TDSg/mbL3d0DxLu1Eb:ANk2BMNWgPgySNu6b
- TLSH T195920805DFA748F2ED295AF01CE7D7B94563BF338C298ABBCB88E210B8116318655317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest ed09400bb4c6c941020335923713f1454c6f5b9a1c8cf792bd69702aba0f223c.exe - Looks for VMWare services registry key. 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci ed09400bb4c6c941020335923713f1454c6f5b9a1c8cf792bd69702aba0f223c.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ed09400bb4c6c941020335923713f1454c6f5b9a1c8cf792bd69702aba0f223c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed09400bb4c6c941020335923713f1454c6f5b9a1c8cf792bd69702aba0f223c.exe"C:\Users\Admin\AppData\Local\Temp\ed09400bb4c6c941020335923713f1454c6f5b9a1c8cf792bd69702aba0f223c.exe"1⤵
- Enumerates VirtualBox registry keys
- Looks for VMWare services registry key.
- System Location Discovery: System Language Discovery
PID:4552