624b5c47f285a06a2229095d3621f4d3a5a5ecd4d671828b19e759915adbbd63

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
624b5c47f285a06a2229095d3621f4d3a5a5ecd4d671828b19e759915adbbd63.exe
Size 2.1MB
Sample260718-wembasct8w
SHA256 624b5c47f285a06a2229095d3621f4d3a5a5ecd4d671828b19e759915adbbd63
MD5 ea6885d79e8a030cfb28bf2c9f9f4b53
SHA1 a235cea08808ecf12a1de76cf79ad127a169c47a
SHA512 a570b2c9c5c6ecc62fb1ce1ba9da6162b07d3c69eb28a346830e409663a25645b5083c98ea3ecad8d947ba0109b34dafc2e8cbc0b5b30c9eb1f74f72abff740c
SSDEEP 49152:rM0VmKBFWj0MMdCBanfoqzac0IpJTa2TQtJFbnW0aSgu0XbrnZL+Obz:rJmKBgjId5nfoqzac0IpJTMFbn9gu0Xh
TLSH
T17BA5AE313A90C076C57B3530925AA3F8E6BEAD308D3A461766E06E3D3E35582953877F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4472	624b5c47f285a06a2229095d3621f4d3a5a5ecd4d671828b19e759915adbbd63.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	624b5c47f285a06a2229095d3621f4d3a5a5ecd4d671828b19e759915adbbd63.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4472	624b5c47f285a06a2229095d3621f4d3a5a5ecd4d671828b19e759915adbbd63.exe
4472	624b5c47f285a06a2229095d3621f4d3a5a5ecd4d671828b19e759915adbbd63.exe
4472	624b5c47f285a06a2229095d3621f4d3a5a5ecd4d671828b19e759915adbbd63.exe

C:\Users\Admin\AppData\Local\Temp\624b5c47f285a06a2229095d3621f4d3a5a5ecd4d671828b19e759915adbbd63.exe
"C:\Users\Admin\AppData\Local\Temp\624b5c47f285a06a2229095d3621f4d3a5a5ecd4d671828b19e759915adbbd63.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceUsb.dll

Path C:\Users\Admin\AppData\Local\Temp\DeviceUsb.dll
Size 8KB
SHA256 fad660bc7e006c58f37db9d75b72bf30c089ef62fc4e72673cbfd424d247b5e5
MD5 4af659cb04807c2015339d8ba0ed4fc6
SHA1 02316dc51ce2d959c12fd370529a31fdc0535932
SHA512 aa92fcb39cd85702d52044ab6cc9bcdb35ff372c9e620c8a16201ee5c30d5d4235a213a34043fcf538e973b32d04278ea7410ee1c0a3a88e0ba13cd34310d151
SSDEEP 192:MSmqiJy0qZnpFoT6i7wi9IacPIx+xO3X+cqZVN6GW:OhMOP7j9Iacc+QuvW
TLSH
T144022B3DEA834063EA0C06F66D9762764B7D121733D230FBB760549A1ED06D1F8B063A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download