Analysis
- user interaction
yes - max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 22:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Dive.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Dive.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target Dive.exe
- Size 26KB
- Sample260522-2rl4ysas4y
- SHA256 f165115bda695316c8a6f7441e610314d47ebc8b8bf407c12fbf2fb83e6ffd3f
- MD5 294ce878d0f19eaedaaa5a5fa8117dc8
- SHA1 e54e5ee1c5f2ca248a296268245ae28fb4a5443c
- SHA512 15049a28ca92b5d2d0af3b650f5657f80dc8598b427a055433833f6eede39dcbdc351573351b8e21efd3b4b42add588420d0ff9d0e5ce2385ffb65b010d55284
- SSDEEP 768:KXl/G3MjYH/lRmNui66YTLKzxxO5WJUuGTOZgo9:KXl/s9tRmci61SQ5WquqOZh
- TLSH T12BC2C6885EDD7623FE5F4ABD406D42436BB391379032EB4C15ACA09637C339609C9BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dive.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe 2248 Dive.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2248 Dive.exe