32e4148fe01802bac9f16f3530076ec38b564757e0d056dc5b152d700bc04580

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
32e4148fe01802bac9f16f3530076ec38b564757e0d056dc5b152d700bc04580.exe
Size 356KB
Sample260804-jt29vaff85
SHA256 32e4148fe01802bac9f16f3530076ec38b564757e0d056dc5b152d700bc04580
MD5 6321e706f0662d9294a5bf882719464f
SHA1 10a861f813802bde107ca3ad409ccf56b2e14dd3
SHA512 670c9cca9c95e3c26b5a097752e7cb33019714b8a54103b5942ce3d4ee3f916363b05e2f357fec59826e2d97e6a181919c9fde3416f2d411433cd2767269e976
SSDEEP 6144:4Zssv5EnjibEh5SUiQ2Jd1+5bQ0pxtywqHbKSJe:4LBEnjibEhpiQ2n10soxtMb
TLSH
T1E274BF53B2F2FE73C69605314EF90A387BF9BD481A324B87374A8B0D6931951B627721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2596	NohXEwojb.exe

Loads dropped DLL 1 IoCs

pid	Process
2596	NohXEwojb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32e4148fe01802bac9f16f3530076ec38b564757e0d056dc5b152d700bc04580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NohXEwojb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3348	32e4148fe01802bac9f16f3530076ec38b564757e0d056dc5b152d700bc04580.exe
3348	32e4148fe01802bac9f16f3530076ec38b564757e0d056dc5b152d700bc04580.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 2596	3348	32e4148fe01802bac9f16f3530076ec38b564757e0d056dc5b152d700bc04580.exe	89

C:\Users\Admin\AppData\Local\Temp\32e4148fe01802bac9f16f3530076ec38b564757e0d056dc5b152d700bc04580.exe
"C:\Users\Admin\AppData\Local\Temp\32e4148fe01802bac9f16f3530076ec38b564757e0d056dc5b152d700bc04580.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Users\Admin\AppData\Local\Temp\NohXEwojb.exe
  "C:\Users\Admin\AppData\Local\Temp\NohXEwojb.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6.d

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\6.d
Size 733KB
SHA256 23670f22fca090d29fd3afcd24006e7135de9172e3ca6c5bb4227204b6c820d9
MD5 e967078eeee832914b905b3dd094605a
SHA1 ca8458a653acaa4112a60cbefb138c783cfa05ae
SHA512 ddc9b3ca2f79968a9c78d9d72ba9015e594fc8bb8cd2bbed9583fa6ff9fe7860755df81c27c5654cc5be340942722d0ab50f3cb79693c079727ed7630555dd9d
SSDEEP 12288:KtLB9yT+5ORa5bZ5iZnseEpuUuDEP5C7FLDRAvhT5eHY/g//7C/F0DWjdg0x+RK7:64+8+bZ5iZ0YUufLDRA95eHYt0DWjfVx
TLSH
T107F433B6B2122B952756780A8E606FFC3DEF85E94C07C7019D4B5E2C2C44B76E928D63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7.d

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\7.d
Size 105KB
SHA256 8f5706af383ff00159009af79b8e512960ff534dc888f0909d8ee0e9b1c13776
MD5 4192bfc3e53448be670bd8dc205ade03
SHA1 17f61d3b3c7863ad409c78b3a619496d50fb4477
SHA512 cb15f2530695b651fc98a7cc67e73cc21cd165964befd8eb517e46968277fbe0a85228a7fb67dcc541b151b9f5edaa87e53c49c7a150c50c115d9e3595f26f3a
SSDEEP 1536:b/LYr9emNsVvicTiUemMrbRgfysRrgjtIYLi4BUlx8MHfM4r7tQPCYi5skHOPIcA:bTYr9C4c9JM9sREtyz8Oft7BYiIkt
TLSH
T123B312A3900E9B241E32D767A13D1ABBC800690B57110BFB9CDE79F1E7B757F9462284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NohXEwojb.exe

Path C:\Users\Admin\AppData\Local\Temp\NohXEwojb.exe
Size 1.1MB
SHA256 b1cbc18001014555bf311886ea036bc9c5e3c74224330a0dfb77f196433b3177
MD5 1d6546d874e5f48d15b78a090e63151a
SHA1 9abc3b071f75f45a17e60d213ece4be5ca20b97e
SHA512 821e9ac91e08a96f40ee830964e8c24fa7774521749923be98310cddbd3ba5b430e94a2fa87e5db82ab7a56eb39bc41c9e9596a2a04b3ca2f4129cdf077f73bf
SSDEEP 24576:+vvp/A7bp2CTa4a0J5loGgTd/JAFq3utiCU+bx:cpY7l2qtzloXTbAA+tiUx
TLSH
T1DD35CF50B542C077C1930171493CFBB655BCBE384B3495EB63D86B3EAE306C25E3AA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\zlib1.dll
Size 156KB
SHA256 af27bff25b247a7a21ccf329dc57e3ab449cd88400140357c2aa1afd554a3c33
MD5 3384fb81567642d82edefa8b6047bb47
SHA1 9e45625f8dd7907716aeb93b19945e0702039367
SHA512 228522b1fa84ff2d146dbb497c73f0e0372904c82cbd3c8a7a139d3cbfc00eccaf82cacc46d22e58d135b6bc628b8fb9df7495fd0bc19826ebc9c56388c105eb
SSDEEP 3072:mRiw05g0BCxugXLiAT2pggUTovtJySzx3rN:mSjCxugD2pgTovySZ
TLSH
T18FF3AE167260C07AD29D453D4E627B37A3FBF8A0DFF28A075B68D75C1D30A518F26226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3348-8-0x00000000037D0000-0x00000000037E8000-memory.dmp

Download

memory/3348-9-0x0000000010000000-0x000000001001C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads