0cc336b558b47d9ed2f4b2a16503aff5f0f0c9560f12c885a33a10b12356cc5e

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0cc336b558b47d9ed2f4b2a16503aff5f0f0c9560f12c885a33a10b12356cc5e.exe
Size 11.2MB
Sample260601-kel5rahv2p
SHA256 0cc336b558b47d9ed2f4b2a16503aff5f0f0c9560f12c885a33a10b12356cc5e
MD5 f2d69996f6e01d120e842b4c7953b695
SHA1 1f8f564cb0203d57be99bf77ec3950edef945d8b
SHA512 acccac48442bac26f5897ba96475696b48ed251082f135ad21b7ae104c5095a039c6456c50b9f1d836afc3a01166291bfb0f79e7c445213195bdcf98d58542f6
SSDEEP 98304:MP0j8b+0ChEPIGiq3y3vx+w9TbfjJ+kdfpK46Tle36jknz9Y:M42+kIGv3y/x+KTbfjJ+kdnAlejY
TLSH
T1A9C67D1F62E810E9D0BAD178D50B4A53EA717C16037197DF13908AAA5FAB7F18E3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	0cc336b558b47d9ed2f4b2a16503aff5f0f0c9560f12c885a33a10b12356cc5e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0cc336b558b47d9ed2f4b2a16503aff5f0f0c9560f12c885a33a10b12356cc5e.exe

C:\Users\Admin\AppData\Local\Temp\0cc336b558b47d9ed2f4b2a16503aff5f0f0c9560f12c885a33a10b12356cc5e.exe
"C:\Users\Admin\AppData\Local\Temp\0cc336b558b47d9ed2f4b2a16503aff5f0f0c9560f12c885a33a10b12356cc5e.exe"
1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
PID:1244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-0-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1244-2-0x0000000000400000-0x000000000043F000-memory.dmp