9b09f141e9bbfa0a7b115095c0abce0d14722910ccd1fac70fad04cd250cf043

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b09f141e9bbfa0a7b115095c0abce0d14722910ccd1fac70fad04cd250cf043.exe
Size 95KB
Sample260802-hhmvcaxalg
SHA256 9b09f141e9bbfa0a7b115095c0abce0d14722910ccd1fac70fad04cd250cf043
MD5 a27638448974fdb444557035e9414f55
SHA1 80728729b1aa1c72d8668b307b84585b71d6c82f
SHA512 d2bed79c5bee091df36bb7e75cb5a5701730e6d0c5d59d9b9e59263b5a06a611e08dca800b862863d0fc1c1229c8372003e691505bfa1f44959007fc6141ff6b
SSDEEP 1536:w0wWesg4fp0rn/iBs5mrgJU5FNYEQ+1ve9zWgIQ3jYYjuVLqVOsVxZNqRazZuqx8:w0NI4hgn/iBcFO575xe9ygxjQVG1jZNS
TLSH
T165A3F1023E187A07DE468C35B55B9C3226F47B8F2E9C5B1F61FD4F9E6A11BA05D0290A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
5872	9b09f141e9bbfa0a7b115095c0abce0d14722910ccd1fac70fad04cd250cf043.exe
5872	9b09f141e9bbfa0a7b115095c0abce0d14722910ccd1fac70fad04cd250cf043.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5872-0-0x0000000000400000-0x0000000000745000-memory.dmp	upx
behavioral2/memory/5872-9-0x0000000000400000-0x0000000000745000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b09f141e9bbfa0a7b115095c0abce0d14722910ccd1fac70fad04cd250cf043.exe

C:\Users\Admin\AppData\Local\Temp\9b09f141e9bbfa0a7b115095c0abce0d14722910ccd1fac70fad04cd250cf043.exe
"C:\Users\Admin\AppData\Local\Temp\9b09f141e9bbfa0a7b115095c0abce0d14722910ccd1fac70fad04cd250cf043.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ThreadTimer.dll

Path C:\Users\Admin\AppData\Local\Temp\nss9488.tmp\ThreadTimer.dll
Size 3KB
SHA256 8b3b4ac7e82ad70222016975d51347abc0e2f8ace27d7a9aae940e3d2140c08f
MD5 1ef958d9667a3e548eabb533ebf18175
SHA1 79f9be24ce78a11944dec5bddd99c3d52a389ffc
SHA512 2a060b23e057a40b21f922368d591ca84117d024c033526ceba26847436f20f230472e23b212bf99dd8746b3e39b7844f502236a912401ea07dd03cba75b5921
TLSH
T18851313B93F454B3E04F17BA56870DD392D7933913DA41CF8BA51908A4803DBAD38744
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nss9488.tmp\nsDialogs.dll
Size 9KB
SHA256 4457d44de8613db6b5a42e218402929f32a8182446b07edb4b84e7a61926cfb3
MD5 7bc0b624c39e9e83e0252db3bfdc34fd
SHA1 7614a90c2960c6ec342f6d9ac614aa855b3c4857
SHA512 dce5138a404a3e86937c6b21e2612041594c08cea26c3d36f89c2ae1479fea177c479f04e8204f5f0ce72be8bf6de4345ac4a53f442dae7653fef17e318a4073
SSDEEP 192:uyz6hxh0ki/EoGk1GkpLplhKCdLHcMD9T:vz9/hhKCdLLD
TLSH
T1A012E65777A599F3DA8F523432563B37C374A220B0A47E07C7338A4D59261963E39312
MD5 SHA1 SHA512 SSDEEP TLSH