673acbd681204f4a936225de3552eb9790710c9c610b93c4c569baedf9877bfd

Resubmissions

05/07/2026, 21:54

260705-1shx9abw9k

05/07/2026, 21:54

260705-1sbtyafy713

Analysis

user interaction
yes
max time kernel
4s
max time network
4s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 21:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bot.dll
Size 160KB
Sample260705-1sbtyafy71
SHA256 673acbd681204f4a936225de3552eb9790710c9c610b93c4c569baedf9877bfd
MD5 6efdd9dcfaa7a377cdd67ba544b5d517
SHA1 54424f8fe939fb3734779ab71543a42569a37795
SHA512 baeef4d58787595cf5da04149926675a440b254979338afd1cc11762323a4168ee7bbb3921a60f4c4447f643e4d365947f9b51cd596db09c880f60d1615c3696
SSDEEP 3072:Nai+lVRwR5FqTnxiQ0xXNK0UXKL6i4e2xx6s/0v5s:NV+VRKW4HxE0gi6QyP/02
TLSH
T1D3F33B60B9585170C8AB527C941E7266D6AF9DB95FE192C32760E3EDECF03C16E3009B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 1276	3860	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bot.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bot.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads