Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 01:43
Behavioral task
behavioral1
Sample
a6c584b93316d7148d3bb3e2cc1031e4f9daea69ac4377eb660f9d1e249a45ba.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
General
- Target a6c584b93316d7148d3bb3e2cc1031e4f9daea69ac4377eb660f9d1e249a45ba.exe
- Size 542KB
- Sample260703-b5k6psex6q
- SHA256 a6c584b93316d7148d3bb3e2cc1031e4f9daea69ac4377eb660f9d1e249a45ba
- MD5 1b5faea78993033a65563d7a0ca8f761
- SHA1 bc37909fccb4c137d4150ad0e603a75c9a7241a4
- SHA512 d849b02734d215b9066b391aeb4918c13239dab157af804e16eecca54e242a511cd5cab61e6b7ac3171525a99225a8eb12e5474aa7907594bb7b706743b18a94
- SSDEEP 12288:8LiToS1yiw3YAvR1AlPExriK0kUlpmXw0MK07AmrQMq:i7GyHocR10M0KvKswjK07AoQM
- TLSH T170C4236E66B464E9C48D9F7111E3CE048E2C5E01581BEFBB085A7CDEB87D16227B1C32
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1704-0-0x0000000000400000-0x0000000000564000-memory.dmp upx behavioral2/memory/1704-3-0x0000000000400000-0x0000000000564000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a6c584b93316d7148d3bb3e2cc1031e4f9daea69ac4377eb660f9d1e249a45ba.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1704 a6c584b93316d7148d3bb3e2cc1031e4f9daea69ac4377eb660f9d1e249a45ba.exe 1704 a6c584b93316d7148d3bb3e2cc1031e4f9daea69ac4377eb660f9d1e249a45ba.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6c584b93316d7148d3bb3e2cc1031e4f9daea69ac4377eb660f9d1e249a45ba.exe"C:\Users\Admin\AppData\Local\Temp\a6c584b93316d7148d3bb3e2cc1031e4f9daea69ac4377eb660f9d1e249a45ba.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1704