33fd90f8dd6647b055cb0249af565b0674a330abf6bc060c6656490f3146b1e4

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 08:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
33fd90f8dd6647b055cb0249af565b0674a330abf6bc060c6656490f3146b1e4.exe
Size 1.9MB
Sample260803-kv26xafa49
SHA256 33fd90f8dd6647b055cb0249af565b0674a330abf6bc060c6656490f3146b1e4
MD5 2c792e28cfd48edc6b833747deba057e
SHA1 d42816de61bb245f1b5fc93f0fa54aa9d763b81b
SHA512 30688bee54429f7f2020a0869b4fdfb19c91bf163eaf082bb5a3b8da103caed7c097391ed8d886973d3380d375aab561c8354c6144786b59d1f1fad9596a2d0c
SSDEEP 24576:K487/UUWJP8MPu8OX8iIQT+AHFCkbEp/+dp4Q6FlZtu1QFztpFCQoXhtVbjft3QG:v0yWmp8DbjV6rW6lg
TLSH
T11F957E23E24080E2C1141AB225E617395DBC9FBA1D74C9D7FBA4EEAD9D71232DB6704C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33fd90f8dd6647b055cb0249af565b0674a330abf6bc060c6656490f3146b1e4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3756	33fd90f8dd6647b055cb0249af565b0674a330abf6bc060c6656490f3146b1e4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3756	33fd90f8dd6647b055cb0249af565b0674a330abf6bc060c6656490f3146b1e4.exe
3756	33fd90f8dd6647b055cb0249af565b0674a330abf6bc060c6656490f3146b1e4.exe

C:\Users\Admin\AppData\Local\Temp\33fd90f8dd6647b055cb0249af565b0674a330abf6bc060c6656490f3146b1e4.exe
"C:\Users\Admin\AppData\Local\Temp\33fd90f8dd6647b055cb0249af565b0674a330abf6bc060c6656490f3146b1e4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

´°¿ÚÅäÖÃ.ini

Path C:\Users\Admin\AppData\Local\Temp\´°¿ÚÅäÖÃ.ini
Size 41B
SHA256 7b34febc947933b826e2e1b3c1a61dad5d286377983f1f8253f95cfd4fbb1834
MD5 a6035be39769dfc934f88ad0025950ae
SHA1 e766fbcedd4a682afc9360368fa0cef36df7609d
SHA512 dc484e4b5e194a9a7654bd20b1c26649e3b3356cec1dcb9410207c1666a50c18a09585c818e2e2fc0c6c00faf56584a82331a106964e864993649f73785af25c
MD5 SHA1 SHA512

Submit Download