4eb9fca1ac0c08bb2eb4d5c47ccd194a0c5038358c43a32a68e2f694c7cf423f

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 12:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payload.exe
Size 59KB
Sample260803-pwffrahe83
SHA256 4eb9fca1ac0c08bb2eb4d5c47ccd194a0c5038358c43a32a68e2f694c7cf423f
MD5 984356822f36e64c275bf90aca74c0f9
SHA1 1c09821b1fbc7e1cddbb207bac5f288e19ad33c4
SHA512 1eaa0c253a04e807316feda7151c92341569c7c7311bda7e39f7406d5c7a1ca047cf1b7b233b2ac28e96c3012cb9b46a05f69126596d710b2688f826238e02b2
SSDEEP 1536:yhP1OeITj/fM+0J/d7wl0DUXaxI3pm4BOe:ylEeITj/U+0tdUl0DUXaxI3pmp
TLSH
T1FF431B0E7BD44944E6BD4BBF94F240120778EC43A622FA1E4AD6A45A3B337D98D44BF1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2376	dw20.exe
Token: SeBackupPrivilege	2376	dw20.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5320 wrote to memory of 2376	5320	Payload.exe	89

C:\Users\Admin\AppData\Local\Temp\Payload.exe
"C:\Users\Admin\AppData\Local\Temp\Payload.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 868
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5320-1-0x0000000074D52000-0x0000000074D54000-memory.dmp

Download

memory/5320-0-0x00000000010F0000-0x0000000001100000-memory.dmp