bc361911cac5a8833ee605557539744c3099740f7377c7d27cfcc891a029c1d8

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bc361911cac5a8833ee605557539744c3099740f7377c7d27cfcc891a029c1d8.exe
Size 589KB
Sample260511-dg8cfady8n
SHA256 bc361911cac5a8833ee605557539744c3099740f7377c7d27cfcc891a029c1d8
MD5 ebef225f547c05b118ec7dcb6dda0b46
SHA1 e78ea5c2ac3de230471f4d2b1c4f49c2bb0ddd74
SHA512 bd700806fbb362c632db206cc4412c972b639354a8b92551a7ca4088e9db89ebe8b89621178344bf49265f865f80a6896967ceb8ebe7261224d5da2ec024008f
SSDEEP 6144:ZsCgQlPMiyBUeILI89nc78GVX7Yd7V4/3gUs/DbVao4qqPIBXtHSWENLVxORtGLG:eCTlveILlnj4YnVWqqPIBONhxsUe3
TLSH
T1C6D4C5E16240F55FF2C09A336FD88B721939F92DC9CA915767802FAA59310F26736633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dlcoer.dll	bc361911cac5a8833ee605557539744c3099740f7377c7d27cfcc891a029c1d8.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	bc361911cac5a8833ee605557539744c3099740f7377c7d27cfcc891a029c1d8.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5020	4124	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc361911cac5a8833ee605557539744c3099740f7377c7d27cfcc891a029c1d8.exe

C:\Users\Admin\AppData\Local\Temp\bc361911cac5a8833ee605557539744c3099740f7377c7d27cfcc891a029c1d8.exe
"C:\Users\Admin\AppData\Local\Temp\bc361911cac5a8833ee605557539744c3099740f7377c7d27cfcc891a029c1d8.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 244
  2⤵
  - Program crash
  PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4124 -ip 4124
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads