Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 18:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
195586044.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
195586044.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target 195586044.exe
- Size 3.9MB
- Sample260709-wt91xaf18w
- SHA256 f5cb3b6fc6a8d8c980d0aef61ecb3910a35358f8a1feaf1d852460a4c1e9701d
- MD5 3cdb726af3c12f69c561490ef0f4c77f
- SHA1 8d173ae55e853ca726079f7cde5f43993bd9bc7d
- SHA512 2be5bf163e9443e6ee29ab2d272e1b955d1cb5bea31ed5c58162341ebc25e598db246db03a18c3c4b090bc300a610f463bd2031f333c3696fd3e7cda2df7598d
- SSDEEP 98304:4sEwnZsyVW9YLXn54lkiILV259PaNeNTo82Pb0c0NZx:FEwnZsyV9LXviMQCcyszNX
- TLSH T1C616233D74211814D05B7336BD6C2108D3661F9B2398EBB0988FBB183BF7963B5A519B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 5392 195586044.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 5392 195586044.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 195586044.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 195586044.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 195586044.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\z26731.dll
- Size 2.1MB
- SHA256 4d3ceb6af02d2479cb823fb4a66de2389137213d382e940857dd0a68bfb22add
- MD5 d7d829a50fed0f6814d6a2b54741415f
- SHA1 34af00f9dab0ee74188e724b8dfc40ffab78e39d
- SHA512 539c18a7f3839f3583dfa7908b65091b14bc1429f7627a25e6ef78348cf678014e02c942d5f45d78aafa093b8c57b845426231ca5e7209911c8ea6cbc96e0e75
- SSDEEP 49152:Gwc7GVRsgugiNREiqWIYMPPbwCs5zIfaP2POy4CaaeS4/:GwcqRsgu9MzCM0tzkPICasY
- TLSH T13BA523C5FDB51237E37745B16816A9DCD9F04CE21F2AC5BF83E102927AB26B1613A243
- MD5 SHA1 SHA512 SSDEEP TLSH