f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951.exe
Size 89KB
Sample260803-dtd95a1xev
SHA256 f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951
MD5 c49016c472862bd68a9bbe5ae3e4b0c4
SHA1 a3ade1c2084c6ae5aba221b7fc62b6cc21aa7f5a
SHA512 fdcfdd1f0889837006d0a8bb21c5f2cf62e017214718654466bf831d3426cf9c9bd9a58b8175fe6d47d321ca6a4c5eb381dbbe69bf5e113444156fb906ca8c1a
SSDEEP 1536:8+gisi/OTW1bk3FwErVvHcTpBignpwLsO9NXw6dciG:8IZ1bk1FVvHcTvO4O9fciG
TLSH
T19A936C0195129237E46344F5A6BA4EBCA17C5BE133822DDBC389FC295B35CE279B205F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5888	bot1.exe
5496	bot1.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4260 set thread context of 4184	4260	f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951.exe	90
PID 5888 set thread context of 5496	5888	bot1.exe	91

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4184-12-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4184-11-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4184-10-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system\bot1.exe	f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951.exe
File opened for modification	C:\Windows\system\bot1.exe	f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951.exe
File opened for modification	C:\Windows\system\RCX5BF1.tmp	f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 5888	4260	f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951.exe	89
PID 4260 wrote to memory of 4184	4260	f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951.exe	90
PID 4260 wrote to memory of 4184	4260	f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951.exe	90
PID 4260 wrote to memory of 4184	4260	f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951.exe	90
PID 4260 wrote to memory of 4184	4260	f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951.exe	90
PID 5888 wrote to memory of 5496	5888	bot1.exe	91
PID 5888 wrote to memory of 5496	5888	bot1.exe	91
PID 5888 wrote to memory of 5496	5888	bot1.exe	91
PID 5888 wrote to memory of 5496	5888	bot1.exe	91

C:\Users\Admin\AppData\Local\Temp\f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951.exe
"C:\Users\Admin\AppData\Local\Temp\f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\system\bot1.exe
  "C:\Windows\system\bot1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Windows\system\bot1.exe
    C:\Windows\system\bot1.exe
    3⤵
    - Executes dropped EXE
    PID:5496
- C:\Users\Admin\AppData\Local\Temp\f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951.exe
  "C:\Users\Admin\AppData\Local\Temp\f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951.exe" -cure -offset=91136 -rcline="C:\Users\Admin\AppData\Local\Temp\f1859b1255d04810d95f0782eaeee3d1ac13b01c8ab14163eb3adfd73b81b951.exe"
  2⤵
  PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot1.exe

Path C:\Windows\system\bot1.exe
Size 88KB
SHA256 097ff710345e53b849c55632369b5ab71be9c3f8032c22c647f5e2d2d2267a9f
MD5 4502416ff83fec34826da32b149bcf0e
SHA1 d74983c0d27baf36ee5618878369a35361cd9aee
SHA512 5fbb40d14c453ff463b7966375db5749187e738f7ef94fc264016791d3a8c56542611d5f2cd5ecd02468208402f5d6dff64762887ddab3c04f621357f5994700
SSDEEP 1536:g+gisi/OTW1bk3FwErVvHcT3BignpwLsO9NXw6dcz:gIZ1bk1FVvHcTBO4O9fcz
TLSH
T13C936D0594129237E46344F5A6BA4EBDA17C5BE133822DDBC389FC294B35CE279B106F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4184-12-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4184-11-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4184-10-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4260-0-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4260-18-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/5888-14-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/5888-26-0x0000000000400000-0x0000000000418000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads