Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/08/2026, 14:35
General
- Target d5765bb641533d513be83a2e6ba11f5be1c43b69e518434958df1f36cce6c7bc.exe
- Size 10.8MB
- Sample260803-rx8vssdm91
- SHA256 d5765bb641533d513be83a2e6ba11f5be1c43b69e518434958df1f36cce6c7bc
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5765bb641533d513be83a2e6ba11f5be1c43b69e518434958df1f36cce6c7bc.exe"C:\Users\Admin\AppData\Local\Temp\d5765bb641533d513be83a2e6ba11f5be1c43b69e518434958df1f36cce6c7bc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d5765bb641533d513be83a2e6ba11f5be1c43b69e518434958df1f36cce6c7bc.exeC:\Users\Admin\AppData\Local\Temp\d5765bb641533d513be83a2e6ba11f5be1c43b69e518434958df1f36cce6c7bc.exe 410238025E02570271026702700271025E02430266026F026B026C025E0243027202720246026302760263025E0250026D0263026F026B026C0265025E02500247025402500276026A0270026A0268025602400240025E02330234026D025402690268026B025802360277025D023B02460254026A025A0268024F025E0268026B0249023A02310253026B0274023702--a\k\`2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\REVRthrhjTBB\16oVkjiZ4u_9DVhXjM\jiK83Qiv5.exe"C:\Users\Admin\AppData\Roaming\REVRthrhjTBB\16oVkjiZ4u_9DVhXjM\jiK83Qiv5.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
jiK83Qiv5.exe
jiK83Qiv5.txt
vjsc.dll
memory/2856-23-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-25-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-11-0x0000000000B60000-0x0000000000B61000-memory.dmp
memory/2856-14-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-16-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-13-0x0000000010000000-0x0000000010068000-memory.dmp
memory/2856-18-0x0000000000B30000-0x0000000000B31000-memory.dmp
memory/2856-17-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/2856-19-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-20-0x0000000010000000-0x0000000010068000-memory.dmp
memory/2856-21-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-9-0x0000000010000000-0x0000000010068000-memory.dmp
memory/2856-24-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-12-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-26-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-27-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-28-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-30-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-31-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-32-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-33-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-34-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-35-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-36-0x0000000002880000-0x0000000002967000-memory.dmp
memory/2856-37-0x0000000002880000-0x0000000002967000-memory.dmp