f991912368b2cbadb58adf30a17aff758fdfa8eb77353514d53870a1affb1d95

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f991912368b2cbadb58adf30a17aff758fdfa8eb77353514d53870a1affb1d95.exe
Size 1.6MB
Sample260802-cda24abn3x
SHA256 f991912368b2cbadb58adf30a17aff758fdfa8eb77353514d53870a1affb1d95
MD5 a7ea56331655e766b5152c777580ad5e
SHA1 85941a21f6056a40077963c7f6b5dad45b840eb9
SHA512 e43405165c35c9b3d758e547cdb3f56236ee1479a05c1ccf5f961f8cf5e3c1827e457e8001b8ff37dda8c6f0411a66680384e430c73407bc5c81bc73d4c4ba24
SSDEEP 49152:2P7E6dig9gk39ZynV4oDabuWbDQOcIxJJf5:+7E6dXgMP+RDabpd5
TLSH
T12E7512527B2180F1C49716719961E73DF77056018B78CDD3E7C8AEA05CA36E63A3B38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4740	1F0D0E0F120C156A155E15D0B0D160C0C160C.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4072	f991912368b2cbadb58adf30a17aff758fdfa8eb77353514d53870a1affb1d95.exe
4740	1F0D0E0F120C156A155E15D0B0D160C0C160C.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f991912368b2cbadb58adf30a17aff758fdfa8eb77353514d53870a1affb1d95.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1F0D0E0F120C156A155E15D0B0D160C0C160C.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4740	4072	f991912368b2cbadb58adf30a17aff758fdfa8eb77353514d53870a1affb1d95.exe	88

C:\Users\Admin\AppData\Local\Temp\f991912368b2cbadb58adf30a17aff758fdfa8eb77353514d53870a1affb1d95.exe
"C:\Users\Admin\AppData\Local\Temp\f991912368b2cbadb58adf30a17aff758fdfa8eb77353514d53870a1affb1d95.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Local\Temp\1F0D0E0F120C156A155E15D0B0D160C0C160C.exe
  C:\Users\Admin\AppData\Local\Temp\1F0D0E0F120C156A155E15D0B0D160C0C160C.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1F0D0E0F120C156A155E15D0B0D160C0C160C.exe

Path C:\Users\Admin\AppData\Local\Temp\1F0D0E0F120C156A155E15D0B0D160C0C160C.exe
Size 1.6MB
SHA256 71587d673064193a095ba969744afe0f7d8cd6cb1a4e1aa4a257a7a53b4ecded
MD5 2e78dee113153baf94045f1440d5ff69
SHA1 c92f0eeafbb53acf957ec406c76a175f7b69796f
SHA512 85e515aabe1ec0f79d27f2d7a8846177b486ab88959b0e7b3c2bac7c0c487fae11b88fc2e1fede4a71e324992d8968cc535a9cbb0af4c30b703196c3ff2e99a0
SSDEEP 49152:HP7E6dig9gk39ZynV4oDabuWbDQOcIxJJf5:v7E6dXgMP+RDabpd5
TLSH
T1C47512527B2180F1C49716719961E73DF77056018B78CDD3E7C8AEA05CA36E63A3B38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4072-0-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/4072-1-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/4072-7-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/4740-8-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/4740-10-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

memory/4740-11-0x0000000000400000-0x00000000005AD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads