Analysis
- max time kernel
148s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 01:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
63ef10afc812f78fac0609f16b464a539ea6b1f0e271f4d582893d5677f4677e.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
63ef10afc812f78fac0609f16b464a539ea6b1f0e271f4d582893d5677f4677e.exe
Resource
win11ltsc2024-20260629-en
2 signatures
150 seconds
General
- Target 63ef10afc812f78fac0609f16b464a539ea6b1f0e271f4d582893d5677f4677e.exe
- Size 1.2MB
- Sample260703-b5k6psex6r
- SHA256 63ef10afc812f78fac0609f16b464a539ea6b1f0e271f4d582893d5677f4677e
- MD5 b9fc712bdab22e095511b03a916a688e
- SHA1 3617e63967ae2827b0ba1ae2c5fa8f9db7978e1d
- SHA512 a4dcd5b6c438fa6a66a22b406dabeb3acfa8c554c69abb9659c02310cf7137690da45c531f76518b12cdd88bbbca4158280f2c33f6993c5cb1031d3e1f4f2bf8
- SSDEEP 12288:sowLUgGjIjAUjTiNNCNDL1dVO/zVvAwn5Yxbz8lH4tZU9Va/T0e3Gh9vzkKZ:sYjIjACYkq2kYVzzZ1G
- TLSH T17B550A10D106802EDE7711BA8EBF721DB24CAF95434156D7A38C3E294BBA8F1BD3958D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\qidong = "C:\\Users\\Admin\\AppData\\Local\\Temp\\63ef10afc812f78fac0609f16b464a539ea6b1f0e271f4d582893d5677f4677e.exe" 63ef10afc812f78fac0609f16b464a539ea6b1f0e271f4d582893d5677f4677e.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63ef10afc812f78fac0609f16b464a539ea6b1f0e271f4d582893d5677f4677e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63ef10afc812f78fac0609f16b464a539ea6b1f0e271f4d582893d5677f4677e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63ef10afc812f78fac0609f16b464a539ea6b1f0e271f4d582893d5677f4677e.exe"C:\Users\Admin\AppData\Local\Temp\63ef10afc812f78fac0609f16b464a539ea6b1f0e271f4d582893d5677f4677e.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1016
-
C:\Users\Admin\AppData\Local\Temp\63ef10afc812f78fac0609f16b464a539ea6b1f0e271f4d582893d5677f4677e.exeC:\Users\Admin\AppData\Local\Temp\63ef10afc812f78fac0609f16b464a539ea6b1f0e271f4d582893d5677f4677e.exe1⤵
- System Location Discovery: System Language Discovery
PID:6032