ff051213109bca8ae55d458c3eb8c9c0aae12a765ecbb45e6b4b20d4b97b8da7

Analysis

user interaction
yes
max time kernel
598s
max time network
488s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 23:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib/py3-windows-x86_64/libpython3.9.dll
Size 8.3MB
Sample260622-3mhfmsgz7m
SHA256 ff051213109bca8ae55d458c3eb8c9c0aae12a765ecbb45e6b4b20d4b97b8da7
MD5 32d079f77a2383e262b4a512931fb120
SHA1 19902535da3cb79c093f59fd597444a96f143761
SHA512 b1bca949aa2f7b735a9e8e5d4fed3e698f3ce77edb804ec56d0f66d3faffb9d1f82a55bfdfa5393ea5d64cd8379ce9a59a298fa486d21e4ea5f29340d4cde65b
SSDEEP 98304:Dt85Qi40yDueXVj4ka+Pjd2wSY6XO7dPlMBLa2THxM/UZpMBAOd3+opm9g0vHF6:B8r4pr4OjZR/XBA63+opm9g0vHF
TLSH
T160967C23B19150EDD93AC13192975233BBB5BC501B21BBDB2154B7702F72B911FAEB28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\py3-windows-x86_64\libpython3.9.dll,#1
1⤵
PID:5312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:996

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4528

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads