Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 05:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe
- Size 136KB
- Sample260717-ghphhaft91
- SHA256 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1
- MD5 a9a6a3d829718a71fb8be3e54b73cb4f
- SHA1 27dc3a3f098af531e0ea5c5222aa24b9ea77b4b1
- SHA512 7a97f8474d00fb11cfdddbff95d9761c1d1d59d0bc351b498bae94261251b6502b127ae98221e454e2dc91c8859ed2bc055dd8e1323e649817aec262d95c73b4
- SSDEEP 1536:lAbSQ6UYbIMYjoU0Z4Sjex8XcRjCPYs4HPsrhWSmkkfIJ6OvJi2Nxq:ua0jfTKUec92NWFE5iL
- TLSH T186D3C613BAA46226F58B44701C7AC6793D977C3029519D0BA3807F4E28369E3FAB571F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeCreateTokenPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeAssignPrimaryTokenPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeLockMemoryPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeIncreaseQuotaPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeMachineAccountPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeTcbPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeSecurityPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeTakeOwnershipPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeLoadDriverPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeSystemProfilePrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeSystemtimePrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeProfSingleProcessPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeIncBasePriorityPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeCreatePagefilePrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeCreatePermanentPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeBackupPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeRestorePrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeShutdownPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeDebugPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeAuditPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeSystemEnvironmentPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeChangeNotifyPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeRemoteShutdownPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeUndockPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeSyncAgentPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeEnableDelegationPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeManageVolumePrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeImpersonatePrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: SeCreateGlobalPrivilege 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: 31 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: 32 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: 33 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: 34 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe Token: 35 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3872 dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe"C:\Users\Admin\AppData\Local\Temp\dc6bd3e9c30dca0054a98f3755da62bc1c45b45e9a8da05acde5ba26d11521f1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3872
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4424