Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 15:54
Behavioral task
behavioral1
Sample
220e1e2a015b29513c4e89470254beb8313acd1ec8c42d378e659b45dd33bcc9.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
General
- Target 220e1e2a015b29513c4e89470254beb8313acd1ec8c42d378e659b45dd33bcc9.exe
- Size 332KB
- Sample260803-tb6jnavsft
- SHA256 220e1e2a015b29513c4e89470254beb8313acd1ec8c42d378e659b45dd33bcc9
- MD5 a70d6d416656a9e7d187b0782fb8ea10
- SHA1 f9d07fe6fdf15a3647f141affd0bfa8f3d14b8e0
- SHA512 299fc028dac23373b3feb1a783554ccbf851c5d719be09c0693922faa64422c522048203c82207be594f697baf209a3887b4a057370210b5dc8a7abf203e12e8
- SSDEEP 3072:F7BsS3lLyONgeYLccI64UlYuvCm6wwhMdwuNdpf7VRRUUj:dBsSRyQIcY3doMWIZ7f
- TLSH T13E749E33B5D0C4F2D12222321DE14B39BAFCEA311DA246239794EFBA7E355528B1F156
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/800-0-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/800-13-0x0000000000400000-0x0000000000453000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 220e1e2a015b29513c4e89470254beb8313acd1ec8c42d378e659b45dd33bcc9.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 800 220e1e2a015b29513c4e89470254beb8313acd1ec8c42d378e659b45dd33bcc9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\220e1e2a015b29513c4e89470254beb8313acd1ec8c42d378e659b45dd33bcc9.exe"C:\Users\Admin\AppData\Local\Temp\220e1e2a015b29513c4e89470254beb8313acd1ec8c42d378e659b45dd33bcc9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:800
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Bugreport_error.ini
- Size 247B
- SHA256 b4e48c6d475d254315474e26fd64c10d5d3a7fc1a1a0e7ea41f55c17a92085e4
- MD5 8f4b317c8f1447a9d9cfb8aceafa71f2
- SHA1 bc3cdfeba1da5d8d69071f5b817f09dfd5699e5a
- SHA512 713f2d00dba84c12fb99fd03da2d3ca0379a89ec7c2f1b3477289b28eb04f888783a49be05fa0c1daa71bfa9276234e37929e3648703e508629a32c43f4b3f93
- TLSH T1DED05B1F907C91371F3990CB205205D6706A0B7CA25D2AA3322984CD1620CB355D3319
- MD5 SHA1 SHA512 TLSH