0814d894ae0857dc7e8844dd92f51d5dd66e733df533d822c4a779b7df171740

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0814d894ae0857dc7e8844dd92f51d5dd66e733df533d822c4a779b7df171740.exe
Size 8.0MB
Sample260527-tml96aby2q
SHA256 0814d894ae0857dc7e8844dd92f51d5dd66e733df533d822c4a779b7df171740
MD5 7c84b0766c1438594af118704647bb39
SHA1 d35ce15371a1e47473035e968f0a8b52826ccb6b
SHA512 5a2d2783ff69c726b37e2c6f42cc778d073acc5acc8b21bdc529c63e694f304a4ca7d40ab2acbb3c0979120935f0a275d9da70f46781b392e0f1f02e9dc9e283
SSDEEP 196608:gxUFEjTMWXdk2gMiKiE5CaCPYZ5w4KE9d9nPiECW:gxUFxkhizTE5LvYECW
TLSH
T1F486222166AB401BFCB2527078747612053DBE719BF169CB7368B85A6B3E5C02E34B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1164	ESETOnlineScannerBTS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0814d894ae0857dc7e8844dd92f51d5dd66e733df533d822c4a779b7df171740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ESETOnlineScannerBTS.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 1164	2376	0814d894ae0857dc7e8844dd92f51d5dd66e733df533d822c4a779b7df171740.exe	81

C:\Users\Admin\AppData\Local\Temp\0814d894ae0857dc7e8844dd92f51d5dd66e733df533d822c4a779b7df171740.exe
"C:\Users\Admin\AppData\Local\Temp\0814d894ae0857dc7e8844dd92f51d5dd66e733df533d822c4a779b7df171740.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScannerBTS.exe
  "C:\Users\Admin\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScannerBTS.exe" --bts-container 2376 "C:\Users\Admin\AppData\Local\Temp\0814d894ae0857dc7e8844dd92f51d5dd66e733df533d822c4a779b7df171740.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ESETOnlineScannerBTS.exe

Path C:\Users\Admin\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScannerBTS.exe
Size 2.1MB
SHA256 f942615316b76b59b759b08a671629dc374dbaa17f5fc2955082f18e11ec476b
MD5 e07823ac6d5b6afd1b27fa9c9819db91
SHA1 fb4381d478e06de3cb5b883fc6fc6ca9ff0e8814
SHA512 459d8db35d7d3d6ae5b39c0fb3b9e07ef7bcd954a862edf92ef1d2941853045c5d220f8a2cd0969ee3f76b25a29fd87820cc4e294c359d2933fea178eed4c8da
SSDEEP 49152:LezoGaU2h/O6YnnGykhGBkPQEil0C6NtA+Enm649wFMBRyL8:LezfHnGyiGBiS0C68rm08
TLSH
T1FEA56A32B245C022E4B225B2583CDE7B842DBD350B2154C7E7E0BE6E68B55C3663AF57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download