c37045a1d521cca44e327e8582f04eee90faf2ff2bd4f61d9564807b8192e953

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 06:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c37045a1d521cca44e327e8582f04eee90faf2ff2bd4f61d9564807b8192e953.exe
Size 911KB
Sample260719-hp3jdaes2p
SHA256 c37045a1d521cca44e327e8582f04eee90faf2ff2bd4f61d9564807b8192e953
MD5 cd57929f620940d16e549c254dd9e89c
SHA1 cac562cd3d3f9319385c07257e8b126e718152ac
SHA512 2b17add197fe4b41e3ec56f3c80432408457942b3e6ad230393916f39a0140971e4b207e4e3b3afb771b96af3a399b0f1f74c660a75685646333bd2742335634
SSDEEP 24576:3WujzK70qAeny9eROW2mG/bnAywTiL707b5KmvpWS:3jKgqAQy9Qk/LwTiaKmvIS
TLSH
T16015F1517BC2C0B7D4A705709877E27EF9B534212624DD8BA7C51B097E22BA27E3930E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/2044-0-0x00000000000A0000-0x000000000018A000-memory.dmp	vmprotect
behavioral2/memory/2044-1-0x00000000000A0000-0x000000000018A000-memory.dmp	vmprotect

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c37045a1d521cca44e327e8582f04eee90faf2ff2bd4f61d9564807b8192e953.exe

C:\Users\Admin\AppData\Local\Temp\c37045a1d521cca44e327e8582f04eee90faf2ff2bd4f61d9564807b8192e953.exe
"C:\Users\Admin\AppData\Local\Temp\c37045a1d521cca44e327e8582f04eee90faf2ff2bd4f61d9564807b8192e953.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-0-0x00000000000A0000-0x000000000018A000-memory.dmp

Download

memory/2044-1-0x00000000000A0000-0x000000000018A000-memory.dmp