Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 12:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b0d6488c6b2acbeca992805b40c3e52cee515ebbdc99269c14fab6deb17ce17a.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
b0d6488c6b2acbeca992805b40c3e52cee515ebbdc99269c14fab6deb17ce17a.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target b0d6488c6b2acbeca992805b40c3e52cee515ebbdc99269c14fab6deb17ce17a.exe
- Size 1.9MB
- Sample260801-pg2qfavcmf
- SHA256 b0d6488c6b2acbeca992805b40c3e52cee515ebbdc99269c14fab6deb17ce17a
- MD5 98fcc0d89ab0b06b2ceb478fbe23a6ad
- SHA1 ee74bf9d8b54642dcfdd03b9716df4c353d86e88
- SHA512 8030c0361039310783146e7ac6c207887b15e29b7de1f32f0466e247e04da47c6dc776fa26645d357d1106cde52453e4329b5593c9a27254fc9759277451e317
- SSDEEP 12288:2NkY/J9ue8y5goJJIQkarTencBSu0rq0Nj3V6XEHN4/145AI19z8ktq2N0DmnOKl:2Nbq7y55JiQk8TCc0g/O5nrzv
- TLSH T19595BF3AA9AD60ADC4CB25301473A3F455E2DE46493085F29391A91A7CF32BDF52E13F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b0d6488c6b2acbeca992805b40c3e52cee515ebbdc99269c14fab6deb17ce17a.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3608 b0d6488c6b2acbeca992805b40c3e52cee515ebbdc99269c14fab6deb17ce17a.exe 3608 b0d6488c6b2acbeca992805b40c3e52cee515ebbdc99269c14fab6deb17ce17a.exe 3608 b0d6488c6b2acbeca992805b40c3e52cee515ebbdc99269c14fab6deb17ce17a.exe 3608 b0d6488c6b2acbeca992805b40c3e52cee515ebbdc99269c14fab6deb17ce17a.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3608 b0d6488c6b2acbeca992805b40c3e52cee515ebbdc99269c14fab6deb17ce17a.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3608 b0d6488c6b2acbeca992805b40c3e52cee515ebbdc99269c14fab6deb17ce17a.exe 3608 b0d6488c6b2acbeca992805b40c3e52cee515ebbdc99269c14fab6deb17ce17a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0d6488c6b2acbeca992805b40c3e52cee515ebbdc99269c14fab6deb17ce17a.exe"C:\Users\Admin\AppData\Local\Temp\b0d6488c6b2acbeca992805b40c3e52cee515ebbdc99269c14fab6deb17ce17a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3608