6efc2ed311633933d25312e34cfb56f52f2cf5d2d733070ecc64b49e7c8d6028

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 08:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6efc2ed311633933d25312e34cfb56f52f2cf5d2d733070ecc64b49e7c8d6028.exe
Size 3.9MB
Sample260706-j4ss6ab121
SHA256 6efc2ed311633933d25312e34cfb56f52f2cf5d2d733070ecc64b49e7c8d6028
MD5 68fd4164e3f1272419521838862ce054
SHA1 fbd76ba65a7e1cf2742ebf127ced6ea130566a61
SHA512 c6b86ed734cd156f40dfd4dc3f8c286a1453d0663c41c30ddcfdc541e37982b86fab53a155db88c74565f15e9f9163d7e974e8a3a602244dc08d9ad1aca71855
SSDEEP 98304:Uz2UST9ZvFcO+He5dcvdIduLakHAA5mU1q+y:Ui7lCOJOeduTHAA5j1qX
TLSH
T1E616330903D9F03BDD5BCEB1F9300A3B5B63CA5079A4FF77929689D9B464061D828B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3168	6efc2ed311633933d25312e34cfb56f52f2cf5d2d733070ecc64b49e7c8d6028.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\IsolationGentleman	6efc2ed311633933d25312e34cfb56f52f2cf5d2d733070ecc64b49e7c8d6028.exe
File opened for modification	C:\Windows\TexasAuctions	6efc2ed311633933d25312e34cfb56f52f2cf5d2d733070ecc64b49e7c8d6028.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5972	3168	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6efc2ed311633933d25312e34cfb56f52f2cf5d2d733070ecc64b49e7c8d6028.exe

C:\Users\Admin\AppData\Local\Temp\6efc2ed311633933d25312e34cfb56f52f2cf5d2d733070ecc64b49e7c8d6028.exe
"C:\Users\Admin\AppData\Local\Temp\6efc2ed311633933d25312e34cfb56f52f2cf5d2d733070ecc64b49e7c8d6028.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 736
  2⤵
  - Program crash
  PID:5972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3168 -ip 3168
1⤵
PID:5808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nstFEA1.tmp\nsExec.dll
Size 6KB
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
TLSH
T116C1F7B656C005F3E40D04B93E31280F87FEE426073242769E9B1ECA19D2AA6FD68751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download