649ab86befb2beb32daa1c08b1f79e2a9242f2f5e826ca646de91f27a9874d2f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpmbaa1fpu.exe
Size 110KB
Sample260601-2desqagt2y
SHA256 649ab86befb2beb32daa1c08b1f79e2a9242f2f5e826ca646de91f27a9874d2f
MD5 e1963abbca6e4005bb19f38ba46fae45
SHA1 6d77955c7c9d234fd2b963c0a9702fe7cea2cc2f
SHA512 b19a2687c6809c0d4d8fcc6a424f31cc9529172146b8e90302be04c14be0bfbe841669f27c5eff58b72b16891dbfdcecc03caa26fd0cf87a477f83cde7955f52
SSDEEP 1536:m8s4zFmSauIRNlp/b17ekHbmtI0SWqA2zoLeYG8j2qt5Ozq9h1emba3m13fiV:mvamhlGkHbma0JqrMHGDqt5OzqhVUa
TLSH
T1F9B31937730A80B7D48153B50248FB21BDBFAC221A9D9153F3D5E9842EB4C56E825ADF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpmbaa1fpu.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3828	tmpmbaa1fpu.exe

C:\Users\Admin\AppData\Local\Temp\tmpmbaa1fpu.exe
"C:\Users\Admin\AppData\Local\Temp\tmpmbaa1fpu.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\Users\Admin\AppData\Roaming\yedcos\logs.dat
Size 74B
SHA256 ed460aca696867f601d1a2c1adc07c494a65c1cec13661f7653d92626c1ab7ac
MD5 7c8cf24f476eb9edf06cfd8fbd0b7b10
SHA1 2582ffab37b13775b010dc61aa4ad1e1f64ecc8d
SHA512 bc276e36a9fea000700ecfe18050096adc2335a30e0bfa51cd2a5190b631049e79f208e1a8a665552cb2febfe260f8f661f78a7723af8b321bd7dab97c9a58ce
TLSH
T177A02403074D45D1351D01CFD4D0C350F541D0C7400D04CC55C0140F0010C7D051F4CC
MD5 SHA1 SHA512 TLSH

Submit Download