7eee0207ac1683aa09ffbcd7156b60bf7a4a2ff8e9784da08c1132a71bc7ce7a

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 09:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Easy Paint Tool SAI 2/Tabletka/saicrack.exe
Size 2.7MB
Sample260517-k71tlset3z
SHA256 7eee0207ac1683aa09ffbcd7156b60bf7a4a2ff8e9784da08c1132a71bc7ce7a
MD5 977b525935c4815a57d0fa1da785ca3c
SHA1 4f5791487b63a02a63d956ade1b22c0a70aaa21a
SHA512 a42919085db4c937dbec5b1bc05a7422d01a437d5708c0228c07d2aef7ba12887d7028c9961ae4d5e28a6ecb5698a70ae4e1ffc140408ec6cb92d67e5a3d6eae
SSDEEP 49152:+B1vT++F3IVXwwL0S/MP/xbxBEmZLvHw8/cDD8CIKLTeH847xDOLw:b+dIVAlS/2lBEmZLvQ8/cP88TE770Lw
TLSH
T181D53350B6919075C15618304672C37242F9B5334BA1AE9BF6B409E2BBF13F25B327EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3652	saicrack.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saicrack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saicrack.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 3652	3144	saicrack.exe	81

C:\Users\Admin\AppData\Local\Temp\Easy Paint Tool SAI 2\Tabletka\saicrack.exe
"C:\Users\Admin\AppData\Local\Temp\Easy Paint Tool SAI 2\Tabletka\saicrack.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Users\Admin\AppData\Local\Temp\Easy Paint Tool SAI 2\Tabletka\saicrack.exe
  "C:\Users\Admin\AppData\Local\Temp\Easy Paint Tool SAI 2\Tabletka\saicrack.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

python27.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31442\python27.dll
Size 2.3MB
SHA256 4bf70e90594a6d3fbc042747bb314f541e84c0d5f7ec1cf82beac0afd94b5348
MD5 0689bf814812dd1f04d9e62e69b28123
SHA1 8a2644ec1db354c13b58c4ce32e8e651e4d7c056
SHA512 ebc44c42682917557947f1c20e95094790c29d9ccf466fde4f744d5b4bad0d5e8d0c7f43a3d11217567111ef2aa039960e7db669e6ff87f07baa4469b9060aa2
SSDEEP 49152:n6yVQRrXEDRpb56787e9n+ys+bTc5IK6HiOnAGM0MPmzark3SYn:n6yK77+9mpHnAGM0/glY
TLSH
T119B5BF90AA42D0B1DD5A0CF861AA52B72F708D04BB27B9D3D4A87D8CE5731F0567D38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

saicrack.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\_MEI31442\saicrack.exe.manifest
Size 475B
SHA256 10a5fc4b8862ce450f1f94eb1e10ba3b92a3d250a5d75943e9e69b3fbc54ef51
MD5 8b486cc5b709a0a48b61731a6a560729
SHA1 4d9348db41e2a733c1aef006a15c7e28db2f86bb
SHA512 63132fb958d56f05b4e862894947aec33a13592e40ad4be3a4b64a0a5bafe872bd95913dcc4efa99462a6dc08a78b9fbf04a716470e5d772e3e726ac8c55e26b
TLSH
T124F0D401C0C4FD32173105E07BC7D81153CD5322098C0A4E7CB4792B9F1A4DC014717E
MD5 SHA1 SHA512 TLSH