b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb.exe
Size 105KB
Sample260803-spzgtsbd65
SHA256 b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb
MD5 14727317a2f0101be387fa6e658a5cbd
SHA1 9287331c8d45b9972e58f48fdd76f614b6c773a6
SHA512 88db3036c92eb4aee5474e2aea819dbeb5c73a488fba872b63cc2b908da5d7c2a18dfb65f836198975af2a579201d4ca7274959ac5bc57e3503715bc8c31b812
SSDEEP 1536:K+gisi/OTW1bk3FwErVvHcT1xBignpwLsO9NXw6dcZJX:KIZ1bk1FVvHcT1nO4O9fcZZ
TLSH
T18DB30902AE2252A2E86244F15F654B78562C4FD233471EF7934BF865CB35CE27CB129E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2352	bot1.exe
6828	bot1.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1212 set thread context of 4728	1212	b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb.exe	92
PID 2352 set thread context of 6828	2352	bot1.exe	93

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4728-16-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4728-11-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/4728-10-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\RCX6ECD.tmp	b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb.exe
File created	C:\Windows\system\bot1.exe	b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb.exe
File opened for modification	C:\Windows\system\bot1.exe	b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot1.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 2352	1212	b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb.exe	91
PID 1212 wrote to memory of 4728	1212	b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb.exe	92
PID 1212 wrote to memory of 4728	1212	b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb.exe	92
PID 1212 wrote to memory of 4728	1212	b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb.exe	92
PID 1212 wrote to memory of 4728	1212	b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb.exe	92
PID 2352 wrote to memory of 6828	2352	bot1.exe	93
PID 2352 wrote to memory of 6828	2352	bot1.exe	93
PID 2352 wrote to memory of 6828	2352	bot1.exe	93
PID 2352 wrote to memory of 6828	2352	bot1.exe	93

C:\Users\Admin\AppData\Local\Temp\b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb.exe
"C:\Users\Admin\AppData\Local\Temp\b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\system\bot1.exe
  "C:\Windows\system\bot1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\system\bot1.exe
    C:\Windows\system\bot1.exe
    3⤵
    - Executes dropped EXE
    PID:6828
- C:\Users\Admin\AppData\Local\Temp\b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb.exe
  "C:\Users\Admin\AppData\Local\Temp\b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb.exe" -cure -offset=108032 -rcline="C:\Users\Admin\AppData\Local\Temp\b0e518dc38369700b98c7df36483ac6c5b83f00493009ba61bff94b99349abeb.exe"
  2⤵
  PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot1.exe

Path C:\Windows\System\bot1.exe
Size 88KB
SHA256 51b866ff7ddf895b361bfceb71f81d97c8f46e395348c52b882b333868fbfe2d
MD5 d5adb18cc1f96624cd729fb98ef0577a
SHA1 60cfed1caa5a80ed8da0460c53d608048c30dcb4
SHA512 3507b3c647ce717b7f3c2a3d46dd4755ce1611e85184a9ffc31c9ad47420ad37ac9390cf1df98d1f47da5f37d0c4c4a7a65b071b62b297090e9ce9b971cdbeb2
SSDEEP 1536:U+gisi/OTW1bk3FwErVvHcT3BignpwLsO9NXw6dcz:UIZ1bk1FVvHcTBO4O9fcz
TLSH
T149936D0594129237E46344F5A6BA4EBDA17C5BE133822DDBC389FC254B35CE279B106F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-0-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1212-19-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/2352-27-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/2352-17-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4728-16-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4728-11-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4728-10-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads