Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 10:52
Behavioral task
behavioral1
Sample
15d347c1153f9bc4bff6aaefa85a8102cf8c9107a1ea4d5ee23a9736779574d2.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
General
- Target 15d347c1153f9bc4bff6aaefa85a8102cf8c9107a1ea4d5ee23a9736779574d2.exe
- Size 3.4MB
- Sample260731-mytp2sha56
- SHA256 15d347c1153f9bc4bff6aaefa85a8102cf8c9107a1ea4d5ee23a9736779574d2
- MD5 beb1b6f4696ebeac724339ddd76dd74d
- SHA1 4b0503af6d7963a49710b6ca317d98fdc407f17f
- SHA512 6c5032715f411cbf7994d9f8b2cae06e61108a610a793e10ac496b9b11b3ed1b8ce0935242931418052fddccf6cfe13d64a86f1ff2600aefd51bef36a5a8ee7b
- SSDEEP 98304:Djo0mQEe5U9npJE9fAk0Y7LKrAQR0WAkB0/f:DjoXi+k9f4MLKAQTAkB0/
- TLSH T1DDF523F5CAFABCB4F46A6432B82074BC3BCA9C0DDC620525D706B54A30756D269F6E07
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 2880 15d347c1153f9bc4bff6aaefa85a8102cf8c9107a1ea4d5ee23a9736779574d2.exe -
resource yara_rule behavioral2/memory/2880-0-0x0000000000400000-0x00000000008D1000-memory.dmp upx behavioral2/memory/2880-7-0x0000000000400000-0x00000000008D1000-memory.dmp upx behavioral2/memory/2880-8-0x0000000000400000-0x00000000008D1000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15d347c1153f9bc4bff6aaefa85a8102cf8c9107a1ea4d5ee23a9736779574d2.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2880 15d347c1153f9bc4bff6aaefa85a8102cf8c9107a1ea4d5ee23a9736779574d2.exe 2880 15d347c1153f9bc4bff6aaefa85a8102cf8c9107a1ea4d5ee23a9736779574d2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15d347c1153f9bc4bff6aaefa85a8102cf8c9107a1ea4d5ee23a9736779574d2.exe"C:\Users\Admin\AppData\Local\Temp\15d347c1153f9bc4bff6aaefa85a8102cf8c9107a1ea4d5ee23a9736779574d2.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2880
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\E2EECore.2.7.2.dll
- Size 8.4MB
- SHA256 982a177924762f270b36fe34c7d6847392b48ae53151dc2011078dceef487a53
- MD5 8b6c94bbdbfb213e94a5dcb4fac28ce3
- SHA1 b56102ca4f03556f387f8b30e2b404efabe0cb65
- SHA512 9d6d63b5d8cf7a978d7e91126d7a343c2f7acd00022da9d692f63e50835fdd84a59a93328564f10622f2b1f6adfd7febdd98b8ddb294d0754ed45cc9c165d25a
- SSDEEP 98304:z0PpiCcXz5iqFaFxZkyE2kCeQ+LDSBRAN9ijNnQobT9wdxd+tNrspBAUZLh7ZV/T:QyDBaFxZNb+LwRAN9w1X9wdxrpV9/J
- TLSH T1B1968C00F7428166EDCE01B4516AA73D4539BE5407292AD3F34C3E6AAF31AD23F3665E
- MD5 SHA1 SHA512 SSDEEP TLSH