0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b

Resubmissions

06/07/2026, 04:34

260706-e65taahy3x7

06/07/2026, 04:28

260706-e343kshx8v7

06/07/2026, 02:28

260706-cydcyscz7m7

06/07/2026, 02:26

260706-cw7h1scz6k7

Analysis

user interaction
yes
max time kernel
298s
max time network
247s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe
Size 324KB
Sample260706-e65taahy3x
SHA256 0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b
MD5 bff0d401bfb634df88b9e0a534435b43
SHA1 1530ab1f4b0b4f635e2d709b52093cb2a14347bf
SHA512 b192b1d6815bc721c7ea2bacdf44aa40df03e18abd6a310f6a2655f503e29d45bfc5d63433da5262449c093f61959f2d99997725d782137a2edbf1e67baec0c2
SSDEEP 6144:/2lZBsFrLf0ZwhxR23tT8kN57WVyyG54rEWzAPQ0dGJ:/+ZaFrLf0ZwTM3tTHN57AyydrEVo
TLSH
T1C4647C1277E080BAE6A207310FF64779A7BEF9945E358A4B73C4DA1D9D32541CB3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe

Executes dropped EXE 1 IoCs

pid	Process
2716	utpWzdIsHN.exe

Loads dropped DLL 1 IoCs

pid	Process
2716	utpWzdIsHN.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024463-7.dat	upx
behavioral1/memory/2716-41-0x0000000000400000-0x0000000001400000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utpWzdIsHN.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4536	0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe
4536	0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4536	0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe
4536	0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 2716	4536	0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe	85

C:\Users\Admin\AppData\Local\Temp\0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe
"C:\Users\Admin\AppData\Local\Temp\0e071173b997fd6ff92a74b770f133978587d9e3540e114ec9e680b1fe749a0b.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\utpWzdIsHN.exe
  "C:\Users\Admin\AppData\Local\Temp\utpWzdIsHN.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update.dll

Path C:\Users\Admin\AppData\Local\Temp\update.dll
Size 156KB
SHA256 f94d261b527ad996b49e1b05584435f2b9cd4a323689dc4a75c40ada216c5f03
MD5 a70f447ad3f3115552ea0e018c6520fa
SHA1 8b493e9efa235e331a3f77522100f51da83eb03c
SHA512 6b8776c74c09319f56241835f0f1717838c1e3390fdf1e080490fa3d5e84ed0c17a218e2b941598b9967bb19cc1f7d78c21a02462f7bfe820e4f4a47fefd2c87
SSDEEP 3072:lykLMtr26vROUmTMscNY13U25jDGfPtJMWCHFOpI:uxROUYfJU25mfPMWiO
TLSH
T1B1F39F127260C07BD2AD463D4D62AF3793FBF960CEF24A075BA4DB9C2D319419E26217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utpWzdIsHN.exe

Path C:\Users\Admin\AppData\Local\Temp\utpWzdIsHN.exe
Size 8.7MB
SHA256 95aedfcfeeda7f3030b88533b3df9715cd78effd2458d534c672d64f026d4dcb
MD5 f51d43bc8d62fee7460713e35ee8add7
SHA1 10745cfd1a0742e87e46ee923422806ab61c921f
SHA512 923502a8b92e19e38da0e222d0fe0403b2c0d0ddb4e902420b532536525e5bfaaac6482b38e30c964a2b86162844bf820eb974487bc2234269d9090703de1d3f
SSDEEP 196608:jhMeadrf+UOyVAzcwv6aPE9s6oBT9BhV/Fte:jepdrlOyVIcIPPUJc9Bhde
TLSH
T1149623BFD94ADC47E50975F4D9A2E5F14010DC7AC02A6D138CD9BF4AB33A8E99A42433
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Roaming\WonderFox Soft\HD Video Converter Factory Pro\config.ini
Size 21B
SHA256 d967609819ace47a142d98b80281c5f8812cf408d2eb13d593f3b3e1203cfb2a
MD5 8d56828efcb7c4253a3260c5e1c18907
SHA1 cede4be063d0d4914606751ec60e48c398fb0817
SHA512 d30d3a6e9e21d755112da4df9125d64d5211f414eda6af031c16a4f91445bac6b61f099d13dc417217cbc85a1403e8b53ed1644eda1222e685bb923b69cee3db
MD5 SHA1 SHA512

Submit Download

memory/2716-42-0x0000000018300000-0x0000000018377000-memory.dmp

Download

memory/2716-43-0x0000000018830000-0x000000001883D000-memory.dmp

Download

memory/2716-41-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/2716-51-0x0000000018300000-0x0000000018377000-memory.dmp

Download