5b3aea970c9961f1ef673d751af07c50cb8f2812bffd49804492bb4449bdee07

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b3aea970c9961f1ef673d751af07c50cb8f2812bffd49804492bb4449bdee07.exe
Size 1.7MB
Sample260719-3hl82aax5t
SHA256 5b3aea970c9961f1ef673d751af07c50cb8f2812bffd49804492bb4449bdee07
MD5 26b2c0e8d751fd0e464adbb02af52e31
SHA1 e0f3574dfb7df10ce354a6185f3b35109637b25d
SHA512 fc85d553503607facd1179fff62ef06f69abc668eeb6838967c0f6aa953b3e0482527e6675c73fc37d97f040a844608ae84f98444035af8a95e2cd14a38e15b3
SSDEEP 24576:s7FUDowAyrTVE3U5F/RGqKOltoKic6QL3E2vVsjECUAQT45deRV9RX:sBuZrEUkklaKIy029s4C1eH9J
TLSH
T18485CF3FF268A13EC46E1B3245739210997BBA61B81A8C1E47FC384DCF765601E3B656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4248	5b3aea970c9961f1ef673d751af07c50cb8f2812bffd49804492bb4449bdee07.tmp

Loads dropped DLL 1 IoCs

pid	Process
4248	5b3aea970c9961f1ef673d751af07c50cb8f2812bffd49804492bb4449bdee07.tmp

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5476	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b3aea970c9961f1ef673d751af07c50cb8f2812bffd49804492bb4449bdee07.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b3aea970c9961f1ef673d751af07c50cb8f2812bffd49804492bb4449bdee07.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4312-1-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup
behavioral2/memory/4312-13-0x0000000000400000-0x00000000004D8000-memory.dmp	innosetup

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4248	4312	5b3aea970c9961f1ef673d751af07c50cb8f2812bffd49804492bb4449bdee07.exe	89
PID 4248 wrote to memory of 5476	4248	5b3aea970c9961f1ef673d751af07c50cb8f2812bffd49804492bb4449bdee07.tmp	90

C:\Users\Admin\AppData\Local\Temp\5b3aea970c9961f1ef673d751af07c50cb8f2812bffd49804492bb4449bdee07.exe
"C:\Users\Admin\AppData\Local\Temp\5b3aea970c9961f1ef673d751af07c50cb8f2812bffd49804492bb4449bdee07.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Users\Admin\AppData\Local\Temp\is-HG9VC.tmp\5b3aea970c9961f1ef673d751af07c50cb8f2812bffd49804492bb4449bdee07.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HG9VC.tmp\5b3aea970c9961f1ef673d751af07c50cb8f2812bffd49804492bb4449bdee07.tmp" /SL5="$4011E,922170,832512,C:\Users\Admin\AppData\Local\Temp\5b3aea970c9961f1ef673d751af07c50cb8f2812bffd49804492bb4449bdee07.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-9NJAL.tmp\need.bat""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-9NJAL.tmp\idp.dll
Size 232KB
SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
MD5 55c310c0319260d798757557ab3bf636
SHA1 0892eb7ed31d8bb20a56c6835990749011a2d8de
SHA512 e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
SSDEEP 3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
TLSH
T13434AF00B6CBC073D98F0778842B975C0B7AB95557348ACBEB985DADCD213C2AD371A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b3aea970c9961f1ef673d751af07c50cb8f2812bffd49804492bb4449bdee07.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-HG9VC.tmp\5b3aea970c9961f1ef673d751af07c50cb8f2812bffd49804492bb4449bdee07.tmp
Size 3.1MB
SHA256 a3add37f7f195cf0ff49219e9bc9f0e004cab6c9d490b57d1246b982b5a19da9
MD5 97691d890da17ecabe3491adad4f9f4b
SHA1 3017ce4436f5bf4f726556b9d9d0935f5dd4cb41
SHA512 39c51607e05ea8e81e6d62e0a17b63ea97d5c45b151210e646a71dae10b5f9f154f3451cdebcfda0760b1444eda7bad797d1467595614b54213ab5ebcff141dd
SSDEEP 49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
TLSH
T164E53A17F28C713ED06B3A364A3385909837FA6179168C279BFC794C8F365942A3E647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4248-6-0x0000000000A50000-0x0000000000A51000-memory.dmp

Download

memory/4248-12-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/4312-1-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4312-13-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads