4d355ad89e9c6e7fdd343aaf8d80159c08715827ff35737bf09a515cdcf73628

Analysis

max time kernel
40s
max time network
43s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4d355ad89e9c6e7fdd343aaf8d80159c08715827ff35737bf09a515cdcf73628.exe
Size 240KB
Sample260702-mtyhfaew7p
SHA256 4d355ad89e9c6e7fdd343aaf8d80159c08715827ff35737bf09a515cdcf73628
MD5 2c0fb1a4e83ee248f5a86f2a1122645d
SHA1 e02a4876d213c067b9944098233bfb1cab790448
SHA512 a1c09d70401daed8f2acca484a9829b4dda9ddb0886fd8be657cebfe8af4bf9ca71adc7daf04723ea13a5edcb172c92e930e53ef9d5b4b6017051b68a89efd2c
SSDEEP 6144:IXjq4UTPgvFi/4o48vuvQjW1ImZz5PjClw9W:IXm4cgvCk8vuIYx0lwI
TLSH
T11E3423019196E2EBFDD55CF8906583539EF1A8908FDFDDDCA4B25C832E42E050B99AA0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4228-0-0x0000000000BB0000-0x0000000000C3E000-memory.dmp	upx
behavioral2/memory/4228-8-0x0000000000BB0000-0x0000000000C3E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d355ad89e9c6e7fdd343aaf8d80159c08715827ff35737bf09a515cdcf73628.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4228	4d355ad89e9c6e7fdd343aaf8d80159c08715827ff35737bf09a515cdcf73628.exe
4228	4d355ad89e9c6e7fdd343aaf8d80159c08715827ff35737bf09a515cdcf73628.exe

C:\Users\Admin\AppData\Local\Temp\4d355ad89e9c6e7fdd343aaf8d80159c08715827ff35737bf09a515cdcf73628.exe
"C:\Users\Admin\AppData\Local\Temp\4d355ad89e9c6e7fdd343aaf8d80159c08715827ff35737bf09a515cdcf73628.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mservice.exe

Path C:\Users\Admin\AppData\Local\Temp\mservice.exe
Size 1KB
SHA256 16ce845440c38f491f80553aee7a8144dcc0a82c46258deaffdd10a0fa3d2db2
MD5 fc10f358967a59750ef6fd9a698e2d60
SHA1 3fc472d167c41a4193625aff84ee6e599b302002
SHA512 9664693058cb0573a00cb8497bd5866f523fed0553a51417caaea300dbbed793f9fe2fb1b06a946284c2c4769f888a8ea9e7789c3d143398d5ae9b2a7735eb71
TLSH
T11F21EE1FE641194BF25E0064BFE1EB472B1F2167E85C4F713A69E029C2990F568632CC
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4228-0-0x0000000000BB0000-0x0000000000C3E000-memory.dmp

Download

memory/4228-8-0x0000000000BB0000-0x0000000000C3E000-memory.dmp

Download