3be03ef63b8fb8061d8f0c0bfbddd66e6ebb7d4968dc48920156c482c0e21f96

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3be03ef63b8fb8061d8f0c0bfbddd66e6ebb7d4968dc48920156c482c0e21f96.exe
Size 75KB
Sample260724-ft2frs11fw
SHA256 3be03ef63b8fb8061d8f0c0bfbddd66e6ebb7d4968dc48920156c482c0e21f96
MD5 8f86b18dcd8628e5d4c8799f22585fd8
SHA1 5fa2c4907c76d7cde277b4cc49f89863a4da7e9c
SHA512 feb8a97994474d50c452e3d43ee1d209ebac39b9f88608bc0030550857dc85eee6b82fffb173b6bb63ae80204892ba61dfc5d494aae13dd9d447f3672d5dc13c
SSDEEP 1536:WjAkZVETDN20R+/rTs0NSOFulpVq00le/:YAkZmXN20R+jTs0NSOFu/w00k
TLSH
T1DE737D066F5F1102F41B4E70C6A2D1A6CEB9BCE23AAA11DFD720C5453EA17E04536B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
236	3be03ef63b8fb8061d8f0c0bfbddd66e6ebb7d4968dc48920156c482c0e21f96.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3be03ef63b8fb8061d8f0c0bfbddd66e6ebb7d4968dc48920156c482c0e21f96.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 236	3292	3be03ef63b8fb8061d8f0c0bfbddd66e6ebb7d4968dc48920156c482c0e21f96.exe	89

C:\Users\Admin\AppData\Local\Temp\3be03ef63b8fb8061d8f0c0bfbddd66e6ebb7d4968dc48920156c482c0e21f96.exe
"C:\Users\Admin\AppData\Local\Temp\3be03ef63b8fb8061d8f0c0bfbddd66e6ebb7d4968dc48920156c482c0e21f96.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Users\Admin\AppData\Local\Temp\3be03ef63b8fb8061d8f0c0bfbddd66e6ebb7d4968dc48920156c482c0e21f96.exe
  "C:\Users\Admin\AppData\Local\Temp\3be03ef63b8fb8061d8f0c0bfbddd66e6ebb7d4968dc48920156c482c0e21f96.exe"
  2⤵
  - Executes dropped EXE
  PID:236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e595bc2.tmp

Path C:\Users\Admin\AppData\Local\Temp\0e595bc2.tmp
Size 5.2MB
SHA256 1f93c6d172af881a39e7238df0b54cdb5fbc58a94e1f1f745c183f58112307dd
MD5 b24550037f4d77e23e17b832f7a93859
SHA1 cf60e573e70e3f21561038d85c00de89216da50d
SHA512 c5ecf1b7c1e8715b3800922bb0a8c9e99a861f89a3ebe991369554b3bb5fdd531eef508aba7fa9119ecb4688320a59eb7bfac394b6573608d6ff3b8f4d87ad15
SSDEEP 49152:W6Q3sQmSoFCuQrb/TWvO90d7HjmAFd4A64nsfJzDtlod5Pqe8tOCED4PgasvccmI:0wFCu6jHICG+D4y9kULnTH
TLSH
T116468C03BC9560E8C6EED230897A4252B7717C890B3177D32B64B6B92E737D85E39394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3be03ef63b8fb8061d8f0c0bfbddd66e6ebb7d4968dc48920156c482c0e21f96.exe

Path C:\Users\Admin\AppData\Local\Temp\3be03ef63b8fb8061d8f0c0bfbddd66e6ebb7d4968dc48920156c482c0e21f96.exe
Size 43KB
SHA256 a20c35eafc4f2085eb51ec9a778034cd1a3a64544611f1696cb3ac41106eddd1
MD5 66b42283b8cf9ff5b88b9f1c068869a0
SHA1 ac00d2c6fb87d3317bfe3c173a2486e1d036109f
SHA512 c153b34a46136defd807832b0ae8615c6716a7e7ac11a55e1bce221fd84b1ebbcf68d07667d611b5de7d3efc811e3f3c90a2ad8947e008ff396b659a55e15964
SSDEEP 768:G20zV+/r/TaOsOZu176PNLMfd7OFuo8pGonVIbp23+zjle/:G20R+/rTs0NSOFulpVq00le/
TLSH
T121136C435F5D1496F55B8AB4C5E2D227DDB4BDE07BA611CF0030D2852FA27E0263AB2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX5C6F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX5C6F.tmp
Size 32KB
SHA256 29718a4d440276b0417d687a1af517f56d81751b107cd4f24efb02ff704f5e09
MD5 e47907765be51cb24235909628edb851
SHA1 068e1b25e615bf5819994039ebf50f00c78ecd31
SHA512 9a411ac131b4ef9aa2af736eca8d2a21eaaeca87dd891357698c1864ee2e1ab86ef34a9af9ce6318e6ea80af9d77c57092c3dc7d5117444ee5a2af190e9016d8
SSDEEP 384:Wj9xD0sO20SeBcV5fxZ2/AGbzx4fbIot3qnd9ZOxaefMlN+DW6sB0O:WjLv0SpxeAidabHtydtZlNoi3
TLSH
T10DE2090AFD9FA713F4158D70C792A5E98BFEAC63386A617FEF404A0569F00444817AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads