Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 11:27
Behavioral task
behavioral1
Sample
dcda1428e991bd9e57f4addebb23c733ae3fc531d4c9b1932bd8fe9eefec0e0f.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
General
- Target dcda1428e991bd9e57f4addebb23c733ae3fc531d4c9b1932bd8fe9eefec0e0f.exe
- Size 83KB
- Sample260801-nkeveatelc
- SHA256 dcda1428e991bd9e57f4addebb23c733ae3fc531d4c9b1932bd8fe9eefec0e0f
- MD5 305f518dcedaaf003012906005eb751e
- SHA1 4e3a271906f22fa13e5f66b1e5fddf38506bfc30
- SHA512 4f44799869a04f310e7858a26d8a8b0abbcdd3a02e7e5ccbff7bc07ece152a62391cbcfdfd80ae8825012413be15a6ca2e8196144ad619c94c4509958e52d1b5
- SSDEEP 1536:ZXpNyyHW1u4q0pSZs1VomGXlMBCccEgJOjCMdwuqGdpf7VPR:ZX+BE4q0pSZayvMvWOCMdwuNdpf7VZ
- TLSH T16F830107A198A430C9045B7688169A781076DF541B73D7A773817CAA3DF272CBD7E8E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4364-0-0x0000000000400000-0x0000000000442200-memory.dmp upx behavioral2/memory/4364-14-0x0000000000400000-0x0000000000442200-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcda1428e991bd9e57f4addebb23c733ae3fc531d4c9b1932bd8fe9eefec0e0f.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4364 dcda1428e991bd9e57f4addebb23c733ae3fc531d4c9b1932bd8fe9eefec0e0f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcda1428e991bd9e57f4addebb23c733ae3fc531d4c9b1932bd8fe9eefec0e0f.exe"C:\Users\Admin\AppData\Local\Temp\dcda1428e991bd9e57f4addebb23c733ae3fc531d4c9b1932bd8fe9eefec0e0f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4364
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Bugreport_error.ini
- Size 247B
- SHA256 aded9f78818c5f9bfbb0b9caceaddc18702047821442f418ced180cba42087fd
- MD5 49d41782d3bfb022c479e5c4b29d2ba2
- SHA1 5d5d798c33441b7365cea43c2f686baadeab6117
- SHA512 14351b93796960e2fb1dab35b0dca4e9438267b2998c14f8a8c613bf1310e57c5c138c996d559d6e41cdf7be13f3ad182e34c98384d758c64d4a1d7dc703b48e
- TLSH T1B7D09E2F062DA173172A92DAE0B60BEE7065026C363969B33010858E2700D925A37309
- MD5 SHA1 SHA512 TLSH