ea7acb80103ec36ef8d7a50292cce93c4a54880f761f3e73e3fd354e3109d5df

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea7acb80103ec36ef8d7a50292cce93c4a54880f761f3e73e3fd354e3109d5df.exe
Size 184KB
Sample260802-lpkv4sxtcv
SHA256 ea7acb80103ec36ef8d7a50292cce93c4a54880f761f3e73e3fd354e3109d5df
MD5 7298dfb7669a75257a687f763613dbc1
SHA1 c97828d7c1ef3f1293f084deb01a1efa4857a5b7
SHA512 3df0abc381b5f4b09288fbc2cf55fe55def38bad52126b5620e97b00b9411d465a3e5364896118d2b4946bb6749e7a332600222fc37ffd0ac05349aa74534769
SSDEEP 3072:4AkZKbEG5z4hPPxCVwTjlnTw/l3jbEG5z4hPP:4ibVNMwMFTwFbVNM
TLSH
T1EC049E00FED69176E4E1853188F3A737DB3EE82125294B5B93086F9E1C31445EB267AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
600	ea7acb80103ec36ef8d7a50292cce93c4a54880f761f3e73e3fd354e3109d5df.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea7acb80103ec36ef8d7a50292cce93c4a54880f761f3e73e3fd354e3109d5df.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea7acb80103ec36ef8d7a50292cce93c4a54880f761f3e73e3fd354e3109d5df.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 600	4500	ea7acb80103ec36ef8d7a50292cce93c4a54880f761f3e73e3fd354e3109d5df.exe	88

C:\Users\Admin\AppData\Local\Temp\ea7acb80103ec36ef8d7a50292cce93c4a54880f761f3e73e3fd354e3109d5df.exe
"C:\Users\Admin\AppData\Local\Temp\ea7acb80103ec36ef8d7a50292cce93c4a54880f761f3e73e3fd354e3109d5df.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Users\Admin\AppData\Local\Temp\ea7acb80103ec36ef8d7a50292cce93c4a54880f761f3e73e3fd354e3109d5df.exe
  "C:\Users\Admin\AppData\Local\Temp\ea7acb80103ec36ef8d7a50292cce93c4a54880f761f3e73e3fd354e3109d5df.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e58bf44.tmp

Path C:\Users\Admin\AppData\Local\Temp\0e58bf44.tmp
Size 60KB
SHA256 d339b90888c0bba9072e11bd837cd9bc19f39c28d0d90ef17cc8f9c7df8ef82d
MD5 22379fe60c132e6658024401a98da2d7
SHA1 5d21b4e42e329171670db7617a77cead2928a75b
SHA512 0a068db1357cbf5b90b06fecc2cfc239b5676fc75e9c4166b668264a82a776ddbbe5a4acaaf1d28f80612ff6678aa69dbf34796b00cd8891a233304a49677cff
SSDEEP 768:WbLv0SpxeAidabHtydtZlNombEGlF+jrio4WKC22ftXPGQz+yjR:WbAkZV0bEGlF+jriz4fJPGQztR
TLSH
T1C3539D05EE8FE603D04449728AA3F6E5477E8C633919123FDB502F8E6C71946A82797F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea7acb80103ec36ef8d7a50292cce93c4a54880f761f3e73e3fd354e3109d5df.exe

Path C:\Users\Admin\AppData\Local\Temp\ea7acb80103ec36ef8d7a50292cce93c4a54880f761f3e73e3fd354e3109d5df.exe
Size 124KB
SHA256 cd174900f1b078622f44d747c129d07ced961f4689a74c68723cb16217c7553b
MD5 d3b9432cc4ccf146a47c36e4428ba2c0
SHA1 84d10a012ba42f11a56e2a484157e65c2af6573f
SHA512 9dfe2091c4a215476d38fdf30abb46a9a51e6a52d1836d9e4c45b87a3b4b3cc705d76c91a7a16c11d9d0bb3900cd1c09f2d39e0ff48c474dd2c71cc7bdb04d62
SSDEEP 1536:FVnwzfj/N8f+ffQ6809lUB/dJ/l3jbEGlF+jriz4fJPGQz:FVwTjlnTw/l3jbEG5z4hPP
TLSH
T1BCC39E01FBE180AFE5F1017198F79B3A9B3EB95116288E87630C6B5D1C31955AB233DE
MD5 SHA1 SHA512 SSDEEP TLSH