d6ffdd8cc6e4142b3d92a21f2af1b993ac0599b0d1feb07a9ff8a79fa9e425a5

Analysis

max time kernel
148s
max time network
108s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d6ffdd8cc6e4142b3d92a21f2af1b993ac0599b0d1feb07a9ff8a79fa9e425a5.exe
Size 176KB
Sample260708-pg389sgv2m
SHA256 d6ffdd8cc6e4142b3d92a21f2af1b993ac0599b0d1feb07a9ff8a79fa9e425a5
MD5 4473888e333417eee90f70eb2dd1dbd3
SHA1 4ccbd3a9c36125531f38730cb4861a0d751e1ff8
SHA512 46bacbac78cafb02fe64f754664712335afe20a0ee545c87d3582b141726b3ec21d6ed72c7d97155bc95eb6b2263fe1e7a6d6b216ae3bb7c21a50781c1b3be75
SSDEEP 3072:XXD0ZwgC2cEo5snCleQxQ1P0J4afCRuYWigMyJXPKMY0F:XXPKCljq1PAKRuYWigMs
TLSH
T1BE04E72FBA001111E252457328656BB716E33C26D551FC0B628DBE492FF3AB7ADB131B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6ffdd8cc6e4142b3d92a21f2af1b993ac0599b0d1feb07a9ff8a79fa9e425a5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1008	d6ffdd8cc6e4142b3d92a21f2af1b993ac0599b0d1feb07a9ff8a79fa9e425a5.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 4848	1008	d6ffdd8cc6e4142b3d92a21f2af1b993ac0599b0d1feb07a9ff8a79fa9e425a5.exe	87

C:\Users\Admin\AppData\Local\Temp\d6ffdd8cc6e4142b3d92a21f2af1b993ac0599b0d1feb07a9ff8a79fa9e425a5.exe
"C:\Users\Admin\AppData\Local\Temp\d6ffdd8cc6e4142b3d92a21f2af1b993ac0599b0d1feb07a9ff8a79fa9e425a5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\temp\GetPart.bat
  2⤵
  PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GetPart.bat

Path C:\Windows\temp\GetPart.bat
Size 98B
SHA256 f724a5a958d36092a1dd2e8684edeb6da6ff82b99eeb4c32499f3b62649ccea8
MD5 2d1f89869dc8657ffd579dee66f4b40b
SHA1 c190ae3ea592b3e6307a8dc5b5c1182417fd640a
SHA512 ac3d1a098965160d52e615a7b87788c41ade851e941ad71c105a1c1f2246106a9c18b71b5a790a3d8a7815113ff072e1187ed05db55fd1d346fc5a022961be02
TLSH
T169B01230019F8288C0588D330B65219B4EF928397F492B15071A401C180040ABEF2301
MD5 SHA1 SHA512 TLSH

Submit Download