Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 16:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3d0e3e14f71bde11e54b5560cf1c249c95ce392fc38026991492361f6b896e7a.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
General
- Target 3d0e3e14f71bde11e54b5560cf1c249c95ce392fc38026991492361f6b896e7a.exe
- Size 8.5MB
- Sample260724-twypjsgp8v
- SHA256 3d0e3e14f71bde11e54b5560cf1c249c95ce392fc38026991492361f6b896e7a
- MD5 b9319e5effc7fefe97e31a6b068d67d9
- SHA1 2b22e221dedb1c68678e6c2d4e8e68e904869e48
- SHA512 a6820c717db5c199902e5604e980932047f31460fb0fdd8f7566b05e573077b3ad685939c058b9ef473765b7f2169b1f34b10f8e61f93eacea89e1aed199e67e
- SSDEEP 196608:nPhuLaUSh0h4aWRrOmyKQbXmgMUuyzxtuwj4OROx:5uLaUSyh4hAK/yzxJAx
- TLSH T1DC96BE03D745C4E1C8A4DE30C8A39FF5AB76AD0ED9609993A6EDFE637E341584A1E04C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 5504 3d0e3e14f71bde11e54b5560cf1c249c95ce392fc38026991492361f6b896e7a.exe 5504 3d0e3e14f71bde11e54b5560cf1c249c95ce392fc38026991492361f6b896e7a.exe -
resource yara_rule behavioral2/memory/5504-1-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-9-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-50-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-48-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-71-0x000000000DAF0000-0x000000000DB30000-memory.dmp upx behavioral2/memory/5504-65-0x000000000DAF0000-0x000000000DB30000-memory.dmp upx behavioral2/memory/5504-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-11-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-6-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-31-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-7-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/5504-4-0x0000000010000000-0x000000001003E000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d0e3e14f71bde11e54b5560cf1c249c95ce392fc38026991492361f6b896e7a.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 5504 3d0e3e14f71bde11e54b5560cf1c249c95ce392fc38026991492361f6b896e7a.exe 5504 3d0e3e14f71bde11e54b5560cf1c249c95ce392fc38026991492361f6b896e7a.exe 5504 3d0e3e14f71bde11e54b5560cf1c249c95ce392fc38026991492361f6b896e7a.exe 5504 3d0e3e14f71bde11e54b5560cf1c249c95ce392fc38026991492361f6b896e7a.exe 5504 3d0e3e14f71bde11e54b5560cf1c249c95ce392fc38026991492361f6b896e7a.exe 5504 3d0e3e14f71bde11e54b5560cf1c249c95ce392fc38026991492361f6b896e7a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d0e3e14f71bde11e54b5560cf1c249c95ce392fc38026991492361f6b896e7a.exe"C:\Users\Admin\AppData\Local\Temp\3d0e3e14f71bde11e54b5560cf1c249c95ce392fc38026991492361f6b896e7a.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5504
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Documents\speed_change.dll
- Size 189KB
- SHA256 2f77a5e845ee6838bfdc73005e748084a79e18ae0e2de4702224041cde78e0ba
- MD5 4acc9d3311fff9d1ac7697010b43f90b
- SHA1 6874d871367bb522c6c6c08b5234b87f1c3e1c69
- SHA512 b842da8bd37a7df85e9776eed956406cbf3b595e23748121170f57e906123ae3b70a561dc28669b19622ff33007830bd8b248b26526ff95a50ff1f897c92bc12
- SSDEEP 3072:ZNyaW1Pg7kFtOp8+vRha0DAyheYn13qaIhRFXOucMEx32zPzIy2G:ZNyal78m8+vRMEe4a4OEOb8G
- TLSH T194145C57E6128237CA6B7FB8474A49D12AB4E6103CB1D4DF3DD94E8E5B70B606F28207
- MD5 SHA1 SHA512 SSDEEP TLSH