Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 02:17
Behavioral task
behavioral1
Sample
3f0a3fdd9bd6fd3d63dc5170bca4a7f8fa42ea1b8578cbb5720a161d1e38bbe1.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
General
- Target 3f0a3fdd9bd6fd3d63dc5170bca4a7f8fa42ea1b8578cbb5720a161d1e38bbe1.exe
- Size 9.2MB
- Sample260727-cqpe9avanb
- SHA256 3f0a3fdd9bd6fd3d63dc5170bca4a7f8fa42ea1b8578cbb5720a161d1e38bbe1
- MD5 2364f946a29777f7409fe6ea5dba13c7
- SHA1 c38bbc4fe5ca4d5c54ea584f8d9b12fa64ff2add
- SHA512 d9e55361aed07ab46967e24dcd614b27efdb932316c7dd73d901abd3b013de29d3690873f2bab52599f5b4871b94fd74ed90b06c9f597752ff48e650d05ac6da
- SSDEEP 196608:pYSwThBPOC4QLo9Sa7beQTKhm+pF3wuUDcEWy+P8pOy8gOISfNNm:ClTJ4QOBtw3wLlu6O4
- TLSH T1CDA633912526028DF6E7963CF6297DF5DC0BB5189689F1318E6ECBB0913FDD0B889903
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5708-0-0x0000000000400000-0x000000000148C000-memory.dmp upx behavioral2/memory/5708-10-0x0000000000400000-0x000000000148C000-memory.dmp upx behavioral2/memory/5708-11-0x0000000000400000-0x000000000148C000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3f0a3fdd9bd6fd3d63dc5170bca4a7f8fa42ea1b8578cbb5720a161d1e38bbe1.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5708 3f0a3fdd9bd6fd3d63dc5170bca4a7f8fa42ea1b8578cbb5720a161d1e38bbe1.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5708 3f0a3fdd9bd6fd3d63dc5170bca4a7f8fa42ea1b8578cbb5720a161d1e38bbe1.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5708 3f0a3fdd9bd6fd3d63dc5170bca4a7f8fa42ea1b8578cbb5720a161d1e38bbe1.exe 5708 3f0a3fdd9bd6fd3d63dc5170bca4a7f8fa42ea1b8578cbb5720a161d1e38bbe1.exe 5708 3f0a3fdd9bd6fd3d63dc5170bca4a7f8fa42ea1b8578cbb5720a161d1e38bbe1.exe 5708 3f0a3fdd9bd6fd3d63dc5170bca4a7f8fa42ea1b8578cbb5720a161d1e38bbe1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f0a3fdd9bd6fd3d63dc5170bca4a7f8fa42ea1b8578cbb5720a161d1e38bbe1.exe"C:\Users\Admin\AppData\Local\Temp\3f0a3fdd9bd6fd3d63dc5170bca4a7f8fa42ea1b8578cbb5720a161d1e38bbe1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5708