e150bb0678c791ff752205afecf9f0aa55b0493e40bbcdc61e6db18cc96ab37a

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e150bb0678c791ff752205afecf9f0aa55b0493e40bbcdc61e6db18cc96ab37a.exe
Size 7.4MB
Sample260701-2ayfnaft7r
SHA256 e150bb0678c791ff752205afecf9f0aa55b0493e40bbcdc61e6db18cc96ab37a
MD5 79d44b768cedf8fd3070e7348eaa7bd3
SHA1 40ba9c7cae8e2d30b9a35034f8fc98d28c84a12b
SHA512 57b872cd0bbb11833f87a4f1182ffdbdb1b29078990eacbdcd67401164a8ba3deed1a68902423cbe43c927f1e13fc54b7661a34696a4cae584fad1e2c42bac41
SSDEEP 12288:hE1xwwGw0t83sRqyTVICmJUYBqPW+ps+KOgTTxCP:hErow88cRqyWCmCYBCpsDBCP
TLSH
T198769D43B5D380F6EE51163014AA37BAEA715D460A28CE87D3D4DE6D5C33A41DA3F23A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e150bb0678c791ff752205afecf9f0aa55b0493e40bbcdc61e6db18cc96ab37a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2420	e150bb0678c791ff752205afecf9f0aa55b0493e40bbcdc61e6db18cc96ab37a.exe
2420	e150bb0678c791ff752205afecf9f0aa55b0493e40bbcdc61e6db18cc96ab37a.exe

C:\Users\Admin\AppData\Local\Temp\e150bb0678c791ff752205afecf9f0aa55b0493e40bbcdc61e6db18cc96ab37a.exe
"C:\Users\Admin\AppData\Local\Temp\e150bb0678c791ff752205afecf9f0aa55b0493e40bbcdc61e6db18cc96ab37a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2420-0-0x0000000000400000-0x00000000004FF000-memory.dmp

Download