41a2059b376d5c993c47df1cdba3da318203725fa2f0f770432d97a3743638d7

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Update5S.exe
Size 79KB
Sample260605-xerrfsdy4r
SHA256 41a2059b376d5c993c47df1cdba3da318203725fa2f0f770432d97a3743638d7
MD5 b3a9aa3eb57a876ab48fd77a39d6d5c7
SHA1 2c285b9878bbc7760989e7e7e66f210045d999b6
SHA512 4d0b9294d92c1d543e8f8f0aad7607b3be8fd9d47e29230f7067fedad8876604bfb1c4a4c015ec1c90f59f45755e0a3939bf3ea5d8a9fa21702881b166affae2
SSDEEP 1536:VQ33zXMzdkEZTEvGVwa2QirA9Sw2/oGRrbdA:+zXMzdkEZTEO8EUw2/ogrpA
TLSH
T125837B5277E1C13AE58245B222408FBF9E38FA3036156413FB686DF5BE346D64906D8F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery

Malware Config

Signatures

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
980	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update5S.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4508	4736	Update5S.exe	81
PID 4508 wrote to memory of 3292	4508	cmd.exe	82
PID 4736 wrote to memory of 2084	4736	Update5S.exe	83
PID 4736 wrote to memory of 960	4736	Update5S.exe	84
PID 4736 wrote to memory of 4432	4736	Update5S.exe	85
PID 4736 wrote to memory of 980	4736	Update5S.exe	86
PID 980 wrote to memory of 2456	980	cmd.exe	87
PID 4736 wrote to memory of 4028	4736	Update5S.exe	88
PID 4736 wrote to memory of 2332	4736	Update5S.exe	89
PID 4736 wrote to memory of 2348	4736	Update5S.exe	90
PID 4736 wrote to memory of 2820	4736	Update5S.exe	91
PID 4736 wrote to memory of 1004	4736	Update5S.exe	92
PID 1004 wrote to memory of 892	1004	cmd.exe	93
PID 4736 wrote to memory of 2344	4736	Update5S.exe	94
PID 4736 wrote to memory of 4272	4736	Update5S.exe	95

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2456	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Update5S.exe
"C:\Users\Admin\AppData\Local\Temp\Update5S.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con:cols=0120 lines=0030
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\SysWOW64\mode.com
    mode con:cols=0120 lines=0030
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c title Window Title
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\afolder" mkdir "C:\Users\Admin\AppData\Local\Temp\afolder"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\wtmpd" mkdir "C:\Users\Admin\AppData\Local\Temp\wtmpd"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\wtmpd
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h C:\Users\Admin\AppData\Local\Temp\wtmpd
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo:0>C:\Users\Admin\AppData\Local\Temp\i6.t
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\i6.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\wtmpd\tmp42772.bat" del "C:\Users\Admin\AppData\Local\Temp\wtmpd\tmp42772.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\wtmpd\tmp43262.exe" del "C:\Users\Admin\AppData\Local\Temp\wtmpd\tmp43262.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\Sysnative\cmd.exe /C C:\Users\Admin\AppData\Local\Temp\wtmpd\tmp42772.bat "C:\Users\Admin\AppData\Local\Temp\Update5S.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C C:\Users\Admin\AppData\Local\Temp\wtmpd\tmp42772.bat "C:\Users\Admin\AppData\Local\Temp\Update5S.exe"
    3⤵
    PID:892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\wtmpd\tmp42772.bat" del "C:\Users\Admin\AppData\Local\Temp\wtmpd\tmp42772.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c if exist "C:\Users\Admin\AppData\Local\Temp\wtmpd\tmp43262.exe" del "C:\Users\Admin\AppData\Local\Temp\wtmpd\tmp43262.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

i6.bat

Path C:\Users\Admin\AppData\Local\Temp\i6.bat
Size 173B
SHA256 941c169c07670650fc6c6148c1cae068b69bac209e05010594e164aafc7cdf8b
MD5 0f8f70e88009593eefaa155a8e31b1d6
SHA1 eabcc3f2135e0919e9456da0a4b1084f3382d4b6
SHA512 94df468b963f3c9d133a25e1ffa57039fac01fe960f0f738552ca6440e6242ff48d0b410fe70dd05a62e4842c925c9f2b0220ca9eb9cb4ff5490ada443c9a750
TLSH
T1F9C01211A349C50854C4362F157250CDA17E048A65F1EF500B51C45999C2558E7E5212
MD5 SHA1 SHA512 TLSH

Submit Download

i6.f

Path C:\Users\Admin\AppData\Local\Temp\i6.f
Size 32B
SHA256 2e340d2b9ced6ad419c031400fb974feed427cfabd0c167dea26ec732d8579be
MD5 d406619e40f52369e12ae4671b16a11a
SHA1 9c5748148612b1eefaacf368fbf5dbcaa8dea6d0
SHA512 4d9792a6427e4a48553318b4c2bac19ff729a9c0a635bc9196c33d2be5d1a224d1bac30da5f881bad6340b0235894ff020f32061a64125629848e21c879c5264
MD5 SHA1 SHA512

Submit Download

i6.t

Path C:\Users\Admin\AppData\Local\Temp\i6.t
Size 3B
SHA256 f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04
MD5 a5ea0ad9260b1550a14cc58d2c39b03d
SHA1 f0aedf295071ed34ab8c6a7692223d22b6a19841
SHA512 7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74
MD5 SHA1 SHA512

Submit Download

tmp42772.bat

Path C:\Users\Admin\AppData\Local\Temp\wtmpd\tmp42772.bat
Size 3KB
SHA256 61d019c0ac7109c8d6ddf49ee54b6be32addf62fc2495741036be9a9ff90cfe5
MD5 dc4fa5d64ca90d222f97458dc891ae5a
SHA1 1cf78776427d1a099eb4534384c2984296091bdb
SHA512 42ee3b9c7db5609254c4ce176e44e64cd86cac0ffd36f82ae48e1c2f334b8e7c3f197d07c58999b8adfcf935a804f1edd16f293781443286f22e0f2bb1c80079
TLSH
T107714202A502157A49F9ED65EA0880A6FF57C28F0A91195A3413C0F97F345A462FFEEA
MD5 SHA1 SHA512 TLSH

Submit Download

tmp43262.exe

Path C:\Users\Admin\AppData\Local\Temp\wtmpd\tmp43262.exe
Size 15B
SHA256 5614459ec05fdf6110fa8ce54c34e859671eeffba2b7bb4b1ad6c2c6706855ab
MD5 3c52638971ead82b5929d605c1314ee0
SHA1 7318148a40faca203ac402dff51bbb04e638545c
SHA512 46f85f730e3ca9a57f51416c6ab4d03f868f895568eee8f7943cd249b2f71d2a3e83c34e7132715c983d3efaa865a9cb599a4278c911130a0a6948a535c0573b
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads