0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e

Analysis

max time kernel
149s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e.exe
Size 16.9MB
Sample260602-cskvvabx3s
SHA256 0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e
MD5 b808925d2763f91931f3dc619bc5bea9
SHA1 aa564c058682b6320c98e435cdb717a300937656
SHA512 6406408602cfc0af9aeff9e86ac66f802e2579b228140411d46545bc432a368fcb7d39a53b9785b6f3cbd80068bac167a96fa640ff0c62fb64bd2c4e8297c3e6
SSDEEP 393216:3uPqAZ1BbIlNyAD1+wgFrorUzu7ypw/IEbngdfiRg6NPLUTkfUrOfj6H/O18r+:eSAhIuApHgOwa+puIEDglzuLUQ762er+
TLSH
T15A073353B3A9C5B3D43B4A3839B9CB6687777C602132DD5B97D02DAE6B303049632726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
1	4076	x0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e.exe

Executes dropped EXE 1 IoCs

pid	Process
4080	1BC0.exe

Loads dropped DLL 3 IoCs

pid	Process
4076	x0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e.exe
4076	x0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e.exe
4076	x0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	x0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1BC0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4076	x0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e.exe
4076	x0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4076	x0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4080	4076	x0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e.exe	80

C:\Users\Admin\AppData\Local\Temp\x0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e.exe
"C:\Users\Admin\AppData\Local\Temp\x0ac0507dd02e1efcf52837ae4f69cd32ea50a86421f1bc3eacee1dfee8de5c8e.exe"
1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\1BC0.exe
  "C:\Users\Admin\AppData\Local\Temp\1BC0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1BC0.exe

Path C:\Users\Admin\AppData\Local\Temp\1BC0.exe
Size 12KB
SHA256 8e2b78e7c586e36dc3b27c78466fad735f86cdd9b4e7ecbc4c650d934a9a176b
MD5 362fc53afbda6450184b73746802a6fa
SHA1 4c289f978c4c464da05cee4c33101ea7f5291d7b
SHA512 d137b29e9a9ae7ec47dcdb6733e618566cb66d910e33058c5681b61cd3ef0d07e346d4cee19f39c0e1e6918215bb5281caaa5fac204156f46b37c2b63e1b7c81
SSDEEP 192:yW0eU9Y0G5msXhBee6JPJXJxTNerBthIHMzQoh:P0TYgsXhAh9xBerBgMz
TLSH
T11742290AA8091831F3E204B2573E82938BBD19A337D5F9DBFB8067090DB53D5D17966E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fpb.tmp

Path C:\Users\Admin\AppData\Local\Temp\{04DEFB34-9B4F-4F4A-AF62-514E90EDF7AF}\fpb.tmp
Size 819KB
SHA256 6faae3f3c87a0ee22ee51ac4755e654e663d846ca889af64586dda09475fc6e3
MD5 b7060942d30047c5c59dfbe1352ce37a
SHA1 79ea3b72ee7fae8cf4df7b088dbe98c11bf0d7ba
SHA512 7d5c904e34faca6da737d41d30fce83819a9ddd3f2c2172d4ee22663ccdad7ddde95cacd82893a4fedd051ee0535c6e521bfc19fac641f5805e8ce2c75046fc2
SSDEEP 24576:LisZy87alEH/PK9Ar5eKVjtfx2y57MGR12RYAT8:LiyyijVM+f79Oo
TLSH
T1C405F11233D4C532F0BB16385CAAE3A65B77BC701E35E65BB790270E2E343919662372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fpb.tmp

Path C:\Users\Admin\AppData\Local\Temp\{3D81BBF6-8C2A-42F7-9C5B-E29B83D3EBAE}\fpb.tmp
Size 481KB
SHA256 aa5f77ac83364b475fc33c3b4a588be232d8824c2da7393d5162f6e286dd8f5d
MD5 88f9c8e6cb96e509d101c09765574fa8
SHA1 65e8d46b5c51cdd36e510344915c5fe9493dee38
SHA512 1abac231f7288d0e45425c0f96637ff3b5fb26b3915d5a43d411e9e027e47a898c4be5058349acf9e30670026aabe4bc01b7fed9fcc84f3ed7e517c65c568dd8
SSDEEP 6144:Rx3P6b0LksMVJDglgTU1bD6wbmaHhxTB9uSCDdCLHOWyoIiEs:H3P6YMVugTU1bDzCaBxTSDdds
TLSH
T1F4A4070267F88929F1F33B7CBD7EAA980A767D90AD34D15E5760210E19B0790DA70B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download