f506cc9447e2fbdddf700389c94476b376216adfab643c8c449099dcf5c03cd5

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f506cc9447e2fbdddf700389c94476b376216adfab643c8c449099dcf5c03cd5.exe
Size 96KB
Sample260802-dlewpatakb
SHA256 f506cc9447e2fbdddf700389c94476b376216adfab643c8c449099dcf5c03cd5
MD5 13bd54ea0eba3df9a6975cdf39f206bc
SHA1 51ae0d2c2a8f772726685bab942423ffeb9d5e32
SHA512 7559a70c686db4289ca76666df74edc7274be33a8ed9e2666dd871452d51b67ede4f9720725cf1740a5ec1464f0e725741817aaf1d4d7cbd15a2db25dd94de14
SSDEEP 3072:wrbULIE1wHd+9xdHHeQT89c+ApqjPx/bMeoutD:wrbULIE1wHE9xxHeavpqz5geoS
TLSH
T131A35B2376E64533F1761B706CB8679186B7FE323E36865B6385661F0D70A80EC24B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4316-0-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/4316-1-0x0000000000400000-0x000000000041A000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f506cc9447e2fbdddf700389c94476b376216adfab643c8c449099dcf5c03cd5.exe

C:\Users\Admin\AppData\Local\Temp\f506cc9447e2fbdddf700389c94476b376216adfab643c8c449099dcf5c03cd5.exe
"C:\Users\Admin\AppData\Local\Temp\f506cc9447e2fbdddf700389c94476b376216adfab643c8c449099dcf5c03cd5.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4316-0-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4316-1-0x0000000000400000-0x000000000041A000-memory.dmp