e1ec06f9c6202ec28875714fbbfce8f2e15f6038004682c1cb21fdcd176a6600

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/06/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e1ec06f9c6202ec28875714fbbfce8f2e15f6038004682c1cb21fdcd176a6600.exe
Size 2.0MB
Sample260623-pystvscy6j
SHA256 e1ec06f9c6202ec28875714fbbfce8f2e15f6038004682c1cb21fdcd176a6600
MD5 d6fd9e2eafb90871196d66881688b738
SHA1 469840bb3d1f2a15a02d3f1efeb8c68398461b59
SHA512 7cfbf8b50791b0c2871607abb61f807dbb36cfea751a9a504cd689b614e5774a6c7425f100c29602a9321e3bd146fe4a6d94b59196f19e47ce71c84c433c4056
SSDEEP 24576:Y1n4jKxP9782X16F0Y2/5LyXpHsDdrAjCjmCnSpJcJiEwbnp84zfSJ4lXBp+i2JW:qXL72C2GZw984zfSQCi0C
TLSH
T18A957D03FA828DB5D2140630D8EB5FB56B7ADC854E359313BB74FF2D6CB2719A841298
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\d3dx.dat	e1ec06f9c6202ec28875714fbbfce8f2e15f6038004682c1cb21fdcd176a6600.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1ec06f9c6202ec28875714fbbfce8f2e15f6038004682c1cb21fdcd176a6600.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5192	e1ec06f9c6202ec28875714fbbfce8f2e15f6038004682c1cb21fdcd176a6600.exe
5192	e1ec06f9c6202ec28875714fbbfce8f2e15f6038004682c1cb21fdcd176a6600.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5192	e1ec06f9c6202ec28875714fbbfce8f2e15f6038004682c1cb21fdcd176a6600.exe

C:\Users\Admin\AppData\Local\Temp\e1ec06f9c6202ec28875714fbbfce8f2e15f6038004682c1cb21fdcd176a6600.exe
"C:\Users\Admin\AppData\Local\Temp\e1ec06f9c6202ec28875714fbbfce8f2e15f6038004682c1cb21fdcd176a6600.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5192-0-0x0000000074F7B000-0x0000000074F7C000-memory.dmp

Download

memory/5192-1-0x0000000074F00000-0x0000000074FEB000-memory.dmp

Download

memory/5192-2-0x0000000074F00000-0x0000000074FEB000-memory.dmp

Download