c3693a465b935ce368769f456942fba955512cf77a421db5bda2a5f4edbd117e

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c3693a465b935ce368769f456942fba955512cf77a421db5bda2a5f4edbd117e.exe
Size 3.2MB
Sample260720-gr6hdags3n
SHA256 c3693a465b935ce368769f456942fba955512cf77a421db5bda2a5f4edbd117e
MD5 ea4181b632b3b3f1fb10c47bbd010a01
SHA1 ff64cb7d27e1ba9ebeffe6f06e7647a814c64632
SHA512 1e47474a19754eaeb19ebb37b23c8fee275e80522ecf7575da3b45a2397f75de4c480448eb0370d28035afbd168ca407eee1f06df3219b9470d3bc4ee335f7c6
SSDEEP 98304:wBlPdxSb3E1URuFm0zrXYvc1RP+iAyieZu:CSb3EmuFTIvQRP+iAyn8
TLSH
T1F8F53311F7C08AB2D437243E86284E75F63EBC206BB689D763D0952DDB511C0A73A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2976	sefting.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sefting.exe	c3693a465b935ce368769f456942fba955512cf77a421db5bda2a5f4edbd117e.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240739578	c3693a465b935ce368769f456942fba955512cf77a421db5bda2a5f4edbd117e.exe
File created	C:\Windows\MSTeamsSetup.exe	c3693a465b935ce368769f456942fba955512cf77a421db5bda2a5f4edbd117e.exe
File opened for modification	C:\Windows\MSTeamsSetup.exe	c3693a465b935ce368769f456942fba955512cf77a421db5bda2a5f4edbd117e.exe
File created	C:\Windows\sefting.exe	c3693a465b935ce368769f456942fba955512cf77a421db5bda2a5f4edbd117e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3693a465b935ce368769f456942fba955512cf77a421db5bda2a5f4edbd117e.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 2976	5048	c3693a465b935ce368769f456942fba955512cf77a421db5bda2a5f4edbd117e.exe	89

C:\Users\Admin\AppData\Local\Temp\c3693a465b935ce368769f456942fba955512cf77a421db5bda2a5f4edbd117e.exe
"C:\Users\Admin\AppData\Local\Temp\c3693a465b935ce368769f456942fba955512cf77a421db5bda2a5f4edbd117e.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\sefting.exe
  "C:\Windows\sefting.exe"
  2⤵
  - Executes dropped EXE
  PID:2976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sefting.exe

Path C:\Windows\sefting.exe
Size 5.4MB
SHA256 f8dd628d4f6675854f25eedad9480ef52b90aab6af6e207283fc909650f73e55
MD5 0e9cfa89ff9d48538b81f4e198219489
SHA1 870723150388dd8088b75105411b6ab519d077bf
SHA512 a4eb453f2491ad11f7207202796807fcb7120b83284b5d423be33ba6598c3f84c8dcf414288a0aaf70c828106d38767be1f226f8b37c07df4491096c63cd0d70
SSDEEP 49152:Qv1FNXfXEbd+Vrjb4Bu90uMz1xS3MOeb5EAKBhKqF3rbaXwacC3EIU:qsOrjghuM5JEZBpxr2iYEIU
TLSH
T17A464B47EC9146E9C5E9E230CAB68253BA717C455B3163D32B90F7382F76BD0AA79304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download