Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/07/2026, 10:35
Behavioral task
behavioral1
Sample
06c9b1526af192a5d161dedd65c4a3cde17b4c61b167fe4f4771ae7192fff471.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
General
- Target 06c9b1526af192a5d161dedd65c4a3cde17b4c61b167fe4f4771ae7192fff471.exe
- Size 6.6MB
- Sample260722-mmndwsgn21
- SHA256 06c9b1526af192a5d161dedd65c4a3cde17b4c61b167fe4f4771ae7192fff471
- MD5 9aae51063fbc51b64188f705015513ef
- SHA1 0da16300fc04bfd6122d0e42675986b7d7090f89
- SHA512 1cd85b5569af26d62bc9ee38df0a3bb8c6f1f092c6861090be7d49f59d79b11384c93fd59a9ce0fa80f7b65790bf71ae8094b4c48ecb20ec39a830890c73f8f5
- SSDEEP 98304:1qGD0xVJuM3+VilzcHR21nMO+CFSkW8nktKMqIFfKukiAxI5zKLZLyQhMQ8cu:1qBWx6PSAnklgK5zKdLyQOEu
- TLSH T1096633995C3146B3E7B9EAB9DF2AB9739E31A821D5C931313B52DBD304B2AD01758203
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1948-0-0x0000000000400000-0x000000000118A000-memory.dmp upx behavioral1/memory/1948-14-0x0000000000400000-0x000000000118A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06c9b1526af192a5d161dedd65c4a3cde17b4c61b167fe4f4771ae7192fff471.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1948 06c9b1526af192a5d161dedd65c4a3cde17b4c61b167fe4f4771ae7192fff471.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1948 06c9b1526af192a5d161dedd65c4a3cde17b4c61b167fe4f4771ae7192fff471.exe 1948 06c9b1526af192a5d161dedd65c4a3cde17b4c61b167fe4f4771ae7192fff471.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1948 06c9b1526af192a5d161dedd65c4a3cde17b4c61b167fe4f4771ae7192fff471.exe 1948 06c9b1526af192a5d161dedd65c4a3cde17b4c61b167fe4f4771ae7192fff471.exe 1948 06c9b1526af192a5d161dedd65c4a3cde17b4c61b167fe4f4771ae7192fff471.exe 1948 06c9b1526af192a5d161dedd65c4a3cde17b4c61b167fe4f4771ae7192fff471.exe 1948 06c9b1526af192a5d161dedd65c4a3cde17b4c61b167fe4f4771ae7192fff471.exe 1948 06c9b1526af192a5d161dedd65c4a3cde17b4c61b167fe4f4771ae7192fff471.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06c9b1526af192a5d161dedd65c4a3cde17b4c61b167fe4f4771ae7192fff471.exe"C:\Users\Admin\AppData\Local\Temp\06c9b1526af192a5d161dedd65c4a3cde17b4c61b167fe4f4771ae7192fff471.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1948