Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 02:12
Behavioral task
behavioral1
Sample
f39a75222359420b43cce66dcb82c069c9dac1a095589c6459045f7de1e091b7.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
General
- Target f39a75222359420b43cce66dcb82c069c9dac1a095589c6459045f7de1e091b7.exe
- Size 10.7MB
- Sample260801-cm2leaca87
- SHA256 f39a75222359420b43cce66dcb82c069c9dac1a095589c6459045f7de1e091b7
- MD5 141ab28de5c104b6bf25c19902d9c023
- SHA1 c5623992fd4a9b4ebafe3b5a62944fe326c182fa
- SHA512 85091712946c0fe2213a9ef5b2a175e3e6e25059f3b26eedaa3799363445e604ccebe890b9a4fc40f27f4a64087a913d6984e5fea7a418c1186530ebffe83f88
- SSDEEP 196608:pYSwThBPOC4QLo9Sa7beQTKhm+pF3wuUM5SlTl6hs2WsweSGSE8ftgdBk:ClTJ4QOBtw3wk5Az2WfL/NoBk
- TLSH T107B633CE156512DBFBB29A3CA1127DE5CC12900960C8B552CFAECEE5D53ECE11BC9A43
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4292-0-0x0000000000400000-0x000000000148C000-memory.dmp upx behavioral2/memory/4292-250-0x0000000000400000-0x000000000148C000-memory.dmp upx behavioral2/memory/4292-251-0x0000000000400000-0x000000000148C000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f39a75222359420b43cce66dcb82c069c9dac1a095589c6459045f7de1e091b7.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4292 f39a75222359420b43cce66dcb82c069c9dac1a095589c6459045f7de1e091b7.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4292 f39a75222359420b43cce66dcb82c069c9dac1a095589c6459045f7de1e091b7.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4292 f39a75222359420b43cce66dcb82c069c9dac1a095589c6459045f7de1e091b7.exe 4292 f39a75222359420b43cce66dcb82c069c9dac1a095589c6459045f7de1e091b7.exe 4292 f39a75222359420b43cce66dcb82c069c9dac1a095589c6459045f7de1e091b7.exe 4292 f39a75222359420b43cce66dcb82c069c9dac1a095589c6459045f7de1e091b7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f39a75222359420b43cce66dcb82c069c9dac1a095589c6459045f7de1e091b7.exe"C:\Users\Admin\AppData\Local\Temp\f39a75222359420b43cce66dcb82c069c9dac1a095589c6459045f7de1e091b7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4292