0f4a2938afed62aec40ac5a3262687f88688888d2858613cd0dd81982d5d6602

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 06:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DGen_121_Rus.exe
Size 47KB
Sample260720-gy4blabs5v
SHA256 0f4a2938afed62aec40ac5a3262687f88688888d2858613cd0dd81982d5d6602
MD5 9a83e9c0361d85d69668a9a2c0fef97e
SHA1 98c62856a58c2d9d5e2830a1e254c1885d0c8c00
SHA512 d00467ff49100f5390948483a243f7d3c5aeba2ff83f2f8293bd6e3c7ca60bd930c01b27a8dbd75c926cce6db08d5e7dcb679b279e19f07f98b9bba5d7849649
SSDEEP 768:EHRTA6pY4BuSrmVaDs8naXsq8JG5MWtQ6aUlBjf5LRNtL9xKRB+vZFT:EhxPrmVCsmagGOeQ6aUlBD5dL9/t
TLSH
T1D7238DA366D4F7E4C1A272F521BD14EA35BF2C550B600EC78A4BFDBD9E7A32420D0948
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4148-0-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/4148-1-0x0000000000400000-0x0000000000424000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DGen_121_Rus.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	4148	DGen_121_Rus.exe

C:\Users\Admin\AppData\Local\Temp\DGen_121_Rus.exe
"C:\Users\Admin\AppData\Local\Temp\DGen_121_Rus.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4148-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4148-1-0x0000000000400000-0x0000000000424000-memory.dmp