101b10256ce3872d1f28a68fbb9d47d388245e76404880faff1e1b7520202379

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
101b10256ce3872d1f28a68fbb9d47d388245e76404880faff1e1b7520202379.exe
Size 1.0MB
Sample260721-pgc23shc32
SHA256 101b10256ce3872d1f28a68fbb9d47d388245e76404880faff1e1b7520202379
MD5 a091cedfc240608f974f74d440cb0c67
SHA1 fd4de2260c5f0c85548733fddc9227f03c9474c4
SHA512 a7ed9b54cdf6333f65764d6414c50a3b53bb6bd50f16092e16ab9e1b49ae17908f731df6df8de7ed9f8f08ef1392a53a10519f670aa47a53b9e5a8235071324b
SSDEEP 24576:Z9R5kZ6HJ+uWRcZwJmSU/2ajjXhrp4w5a01Mnx:7kZl8SUdXpp4w5a08
TLSH
T13135491273F58139F2F30B706D79A2645A7ABCB15831C61F33D8690D1B71A81EA26B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	101b10256ce3872d1f28a68fbb9d47d388245e76404880faff1e1b7520202379.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	101b10256ce3872d1f28a68fbb9d47d388245e76404880faff1e1b7520202379.exe

C:\Users\Admin\AppData\Local\Temp\101b10256ce3872d1f28a68fbb9d47d388245e76404880faff1e1b7520202379.exe
"C:\Users\Admin\AppData\Local\Temp\101b10256ce3872d1f28a68fbb9d47d388245e76404880faff1e1b7520202379.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:1860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-0-0x00000000006B0000-0x00000000007C1000-memory.dmp

Download