Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 18:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f89dbf96546838367980931dc1aba8c08a69e85806b505328fce83bed58ddd99.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
General
- Target f89dbf96546838367980931dc1aba8c08a69e85806b505328fce83bed58ddd99.exe
- Size 1.3MB
- Sample260722-wtjhysae48
- SHA256 f89dbf96546838367980931dc1aba8c08a69e85806b505328fce83bed58ddd99
- MD5 b1b26de4f091fff6999e31c761b92d05
- SHA1 4231b812d72a3c681b2f88a37171636605355aef
- SHA512 b60f69a5ce672251534cbc13c44c60820730f76fc36f8f7001a2fb0df06f921632fa428c8898fc0c5eff79aa0135500994245235054279eeb9c99085eac0ac46
- SSDEEP 24576:kku54B8rcDjIoci56bfptHRBFzRagX9eS5dO:kkJmrK56jR0gNJO
- TLSH T1F3559E22B383C0F2E1770C7214A62B39C534B9466E28DEC7779DDE6D3F267929622117
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5956-3-0x0000000002510000-0x000000000251B000-memory.dmp upx behavioral2/memory/5956-2-0x0000000010000000-0x000000001001E000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f89dbf96546838367980931dc1aba8c08a69e85806b505328fce83bed58ddd99.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5956 f89dbf96546838367980931dc1aba8c08a69e85806b505328fce83bed58ddd99.exe 5956 f89dbf96546838367980931dc1aba8c08a69e85806b505328fce83bed58ddd99.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f89dbf96546838367980931dc1aba8c08a69e85806b505328fce83bed58ddd99.exe"C:\Users\Admin\AppData\Local\Temp\f89dbf96546838367980931dc1aba8c08a69e85806b505328fce83bed58ddd99.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5956