51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe
Size 298KB
Sample260720-pywwhsaw4p
SHA256 51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f
MD5 c0c0dedfb87d4c312363a9cd0259a128
SHA1 d83c9b52e96203f4f976ab2762a023d3b0bf141c
SHA512 717bd664a5465edde1b4ee771966157ee4db94be9e6b8be889263dee3a8005c6a671460223a5d5c970e9522b2ddf6a0b15ad6cceecf6160b7cbf792a0ca471ae
SSDEEP 6144:I5OhgOWGGYoXGEJE17bKiGJotXLeH14Xk1IAMRER43QtYm26Ndj:fhgOc92AE17HtEAQtYm2Odj
TLSH
T16854120437D8E0B3C92352715A3BCB5F1FA2A9006A98534FA7504F9BBD73541CE6E6B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3592	51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe
3592	51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3592	51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe
3660	51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3592	51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 1728	3592	51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe	89
PID 3592 wrote to memory of 3660	3592	51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe	90
PID 3592 wrote to memory of 3660	3592	51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe	90
PID 3660 wrote to memory of 1852	3660	51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe	91

C:\Users\Admin\AppData\Local\Temp\51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe
"C:\Users\Admin\AppData\Local\Temp\51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Users\Admin\AppData\Local\Temp\51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe
  "C:\Users\Admin\AppData\Local\Temp\51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe"
  2⤵
  PID:1728
- C:\Users\Admin\AppData\Local\Temp\51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe
  "C:\Users\Admin\AppData\Local\Temp\51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Users\Admin\AppData\Local\Temp\51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe
    "C:\Users\Admin\AppData\Local\Temp\51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f.exe"
    3⤵
    PID:1852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsfF625.tmp\System.dll
Size 11KB
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
TLSH
T107324A5503604AF3E986843C086A3BBF6F796B2196F04E53DFA384C0EE6D5C96D78352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3592-15-0x0000000074B64000-0x0000000074B65000-memory.dmp

Download

memory/3660-16-0x0000000077EDF000-0x0000000077EE0000-memory.dmp

Download

memory/3660-17-0x0000000077E9D000-0x0000000077E9E000-memory.dmp

Download

memory/3660-18-0x0000000077F65000-0x0000000077F66000-memory.dmp

Download

memory/3660-19-0x0000000000450000-0x0000000001736000-memory.dmp

Download

memory/3660-20-0x0000000077F65000-0x0000000077F66000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads