e4152620b9c4b5ebb73678d6c8aedddd784a41f80412dcd1d89527e3160f756a

Analysis

user interaction
yes
max time kernel
34s
max time network
34s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
patch.exe
Size 66KB
Sample260801-w42saatcpg
SHA256 e4152620b9c4b5ebb73678d6c8aedddd784a41f80412dcd1d89527e3160f756a
MD5 60f7348c6f666071e3969d16a278711e
SHA1 5ec5f17e237c1d9991c4aae56f093372421771b0
SHA512 1d4027b7bb8bb68d21497293fb611d9a499cb192e0abc2c10690eb86f498e424ea206ee207354297c952fef093f6656d98720e1bd4bea982d447a869cbba4b2c
SSDEEP 1536:6TL5Kt5xaXJ/pvGNSlTGBF8y4GubLj03uxfbnxDLv5j:6T4WR+N0SX8y4RdFbnhR
TLSH
T12063F1928F01215BD054DDB246E70AE05CBCB493D466746BB3D4083B8F4689BE99BCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4348	patch.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patch.exe

C:\Users\Admin\AppData\Local\Temp\patch.exe
"C:\Users\Admin\AppData\Local\Temp\patch.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dup2patcher.dll

Path C:\Users\Admin\AppData\Local\Temp\dup2patcher.dll
Size 60KB
SHA256 7d0a0ea309be7a9992e3549f1389ca9e62d5a59ee813a5ee2f6082f2e7c019da
MD5 468d0760eba95f83965b9ff4c8488d50
SHA1 fc1eaec7537c164c6bddfb1befbd3b108d95c1ba
SHA512 ab4d8bdde786b28c4fd5b3e3c0a9583756261d921a1ec327e695eb63673701d71400586634f7bc1e481d52b39590d1cc12a8d5d7663605a3b36818cb1ff0afa4
SSDEEP 1536:Y/Tilc2ldltF9j6RW8HF/1lxC+oU0ODbiI:6TYc2ldltF9jWW8HF/1lxC+oU0ODb
TLSH
T13753E8546D97817DC3A057352CE99E6086796F31E660E007AF7C1E2C3F21A53EA1BE32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4348-3-0x0000000075400000-0x0000000075427000-memory.dmp

Download