67ff988b5aced3b2a6d46b941c194726f6a4439a8dd32c9ced8c2ec1c8e22448

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
67ff988b5aced3b2a6d46b941c194726f6a4439a8dd32c9ced8c2ec1c8e22448.exe
Size 11.6MB
Sample260712-kdepaaex8k
SHA256 67ff988b5aced3b2a6d46b941c194726f6a4439a8dd32c9ced8c2ec1c8e22448
MD5 bc4e70b3f4e0b233bbc9564766ed3a2e
SHA1 ffec90a66d9a5caea755768569fee8b370195468
SHA512 a9b61278c3c3eaaa95967930f1e4e4202fa00ee4239a98aae0e5b6e5395113834e6d06c5a118a8e744bf13c1b9fed5169a20c7558a1fd0c0a4712c791112ffae
SSDEEP 196608:hF5perlXE7uc74yHjsGvDpdGawipT+DiNrDWD9CcaateaNADc8QLzpDguEo:jO9Ccaa4A28Va
TLSH
T193C61262A25100A6C181DD31593B7B76B6B84B5B0F61AAF3778CFDD92F321E0D323586
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/6104-0-0x0000000000400000-0x0000000000FF1000-memory.dmp	vmprotect
behavioral2/memory/6104-1-0x0000000000400000-0x0000000000FF1000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4932	6104	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67ff988b5aced3b2a6d46b941c194726f6a4439a8dd32c9ced8c2ec1c8e22448.exe

C:\Users\Admin\AppData\Local\Temp\67ff988b5aced3b2a6d46b941c194726f6a4439a8dd32c9ced8c2ec1c8e22448.exe
"C:\Users\Admin\AppData\Local\Temp\67ff988b5aced3b2a6d46b941c194726f6a4439a8dd32c9ced8c2ec1c8e22448.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 612
  2⤵
  - Program crash
  PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6104 -ip 6104
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6104-0-0x0000000000400000-0x0000000000FF1000-memory.dmp

Download

memory/6104-1-0x0000000000400000-0x0000000000FF1000-memory.dmp