dabf438fffbcd795d9efd753e2f5abca66dd217e7491957502025377a71ee7e2

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fernwartung.exe
Size 224KB
Sample260722-plgaashn4x
SHA256 dabf438fffbcd795d9efd753e2f5abca66dd217e7491957502025377a71ee7e2
MD5 7ac1ba9533582f074f1a0de2b8a4cf5f
SHA1 41af11da46128a96cf4da20e82cbeeea04ba549d
SHA512 4a2f982998d06bb04daa3ee856a0ac9256fd094e025fe05aad4dda748bc9dce95c7e35c29ae9826c5c837a36448d7b3ae499ad000e5b43e02ccdd2e0dc948338
SSDEEP 6144:YRgym92YGB+40vPLGPAk+Bwi8tv60seaqBRqNGsJEK:Y6fu+40vPBBwdvnBamqQ4X
TLSH
T1EF24D02138E8C9F6D2411471DE5D7FE5D1F0DE684E22092733A47A2C7EBEA46D006FA9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1160	winvnc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fernwartung.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winvnc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 1160	5048	fernwartung.exe	89

C:\Users\Admin\AppData\Local\Temp\fernwartung.exe
"C:\Users\Admin\AppData\Local\Temp\fernwartung.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\7zSC9A4.tmp\winvnc.exe
  .\winvnc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

background.bmp

Path C:\Users\Admin\AppData\Local\Temp\7zSC9A4.tmp\background.bmp
Size 1KB
SHA256 6fcc92e281d25569d300297ef79a5796bc5e0c226aa35624dd6a9f38b8413402
MD5 6ce6e5fcf1a56b80f4ffa6f685d4329d
SHA1 91780868c241e83754003855407805c0cda20254
SHA512 7af21c8840f56c5ded22161504dd3d6c282ad83a0fb1f711fccfc7d87676de3036120e60e2c0e57fb998a0dcfe512950d3f16e0bdcb493d37a681f31b8cb399f
TLSH
T16D214492E964C4ECCD0A9738E43E264116286003831E8E9CE6AB66500F56717B2BDDF9
MD5 SHA1 SHA512 TLSH

Submit Download

helpdesk.txt

Path C:\Users\Admin\AppData\Local\Temp\7zSC9A4.tmp\helpdesk.txt
Size 1KB
SHA256 43059fe0832fd17c1ef58fc8b213302d24197cf3635b6ad6d6b53b3a18fe8f9f
MD5 ff7e38465fb8a049250557f84bc68391
SHA1 d87a50291e9fa59fbb2c2c6ae68b2d018423d74d
SHA512 11521df0f7f06958537b915ae7f05c75c91bbdece0f867033884531991320ece694fad172aa514c6b269dc1785e0f99346b662fd6f8a185cf179862422e55428
TLSH
T19621F0F60823E19EDBE22144591A0CC2381385648785C7C6BED5A66D704CA8FD6FE8AE
MD5 SHA1 SHA512 TLSH

Submit Download

icon1.ico

Path C:\Users\Admin\AppData\Local\Temp\7zSC9A4.tmp\icon1.ico
Size 3KB
SHA256 a69f7d6b809e0d907e18fbf39213e87396d8cf248c1bfe2a43f1ad83fce9aa68
MD5 58de450364ca9ad6015ce3b7693a0b8e
SHA1 81fef1bef74b230fbab1951fb6e2872abaf1340b
SHA512 603a2fb189f29269d3f4894460c28304dd3bd6adf06baa8c2a130eb95381d7be4031ec016d231a54bebf1e862ec69bf38baa5bbdf2bddff0ff767f6817c3881c
TLSH
T17A611003392ACA94C80009388C4FCFE80524BD87EC10524377F6BF5EACF8750B51A329
MD5 SHA1 SHA512 TLSH

Submit Download

logo.bmp

Path C:\Users\Admin\AppData\Local\Temp\7zSC9A4.tmp\logo.bmp
Size 35KB
SHA256 42d569c2608757206cdcb43541d956236dcab8643249f320e255ebd3ddf3063f
MD5 29c6dfc8cc5d6ba7308c44e75bb2dea0
SHA1 91ba416d569eedef768155c537da36c7d6fda7e0
SHA512 d8903e4535329aca40e9f516f4a53def896788fe15150f378f94850fea8b0431f379bfad988ef8b160b6b09356ced61a292e4f384a3939f5afa61c47968b9db4
SSDEEP 192:kCXfzQfdj++s0rO2HU11wfTLUq8IEaAwSUif1WT3/SB7cKRYta:JXeYf103/SZfRga
TLSH
T132F2FDEB5D8F98DACDD02E3A45DAD7AC4D9A162C4FB017CB314D9D04E20676B093B3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winvnc.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC9A4.tmp\winvnc.exe
Size 236KB
SHA256 50831333c6ba49fc871ca20f4a4778119e24fb975912023fd4c8bfd72b45c191
MD5 77de6bb7c680776fa67a5646072b7fed
SHA1 7f3c35d85c96ff903844feaf1aed010a34119c40
SHA512 c7e84578ac2ad87c4595496e695f66245910a446aaa54cc2540feed18a0cc6933d88570aa0280749e5ae8374f6643d20e98ca57f6ad437cc3dc6acf916a4bd5a
SSDEEP 6144:m29TBjaTIx+DCc1BzkxDqOUKTvc3cRdwkvr3Pwn+nE:m29TqrL+URMHwIwn+nE
TLSH
T141348D6E6D74C033D1B3163184A99718FFF9ED388A61CC87C35885685A72726AB3178F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads