Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
31/05/2026, 12:57
Behavioral task
behavioral1
Sample
ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe
- Size 1.3MB
- Sample260531-p7ch8sa17p
- SHA256 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb
- MD5 3d24b9d3c1fcdd14726565dabb1980a0
- SHA1 317551ca070ffb7cc80bc88c7d156b121021276c
- SHA512 c4a8a478041596f6b34886bc4d8df824f886a66593d2e6239628ed455e729e3ecba95e4833391c3ff0eda2f5e7afc5a59abf4fdefacf5f78ce06d84d56ff75e0
- SSDEEP 24576:gX0hD34ShYVRyg0pqkuIY242UFvd/No3X+AfvXERS4bANxuYKYZgq:gEcShYV90pg2Un+3upNkzuYa
- TLSH T10755230D3095B00DE0F6DAF3ED29E2731E203891B925EBEE5550BB1E24FD289D91DB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2444-3-0x00000000004D0000-0x000000000079A000-memory.dmp autoit_exe behavioral2/memory/2444-4-0x00000000004D0000-0x000000000079A000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/2444-0-0x00000000004D0000-0x000000000079A000-memory.dmp upx behavioral2/memory/2444-3-0x00000000004D0000-0x000000000079A000-memory.dmp upx behavioral2/memory/2444-4-0x00000000004D0000-0x000000000079A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe - Suspicious use of FindShellTrayWindow 23 IoCs
pid Process 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe - Suspicious use of SendNotifyMessage 23 IoCs
pid Process 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe 2444 ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe"C:\Users\Admin\AppData\Local\Temp\ab875c361189ca03937bc3ce6f662a9a1cf846b1531ef66f58c1016f182198eb.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2444