b3ce058b7cbed7bfa59f7365c5d86b72958c0938c09f9b1d9aaac486f813fcf7

Analysis

max time kernel
24s
max time network
29s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bootloader.exe
Size 3.4MB
Sample260804-s5pybs1yav
SHA256 b3ce058b7cbed7bfa59f7365c5d86b72958c0938c09f9b1d9aaac486f813fcf7
MD5 e19899dffa4dafe7a2e4f1ae7e6dfbd8
SHA1 c2ecff27a68233271b2754b67b94371e178dd3fe
SHA512 770f9a75f0c573419cd9859ed33bbc3c72991f0541be8cf4695a15287bd8ac4c7753461e58c43b8f0165f42cfcf4ecbd52b62284701b600f4ee5042d090a4d7c
SSDEEP 98304:aiM5GjZjYfQfQUZweSInsoeMXlnzBB0YGYtDAmVglqWFQutes8qKJ:9X8OZWIsor1zBB0PaAdkWHtes9K
TLSH
T113F53315A0A188B7D173083A1EF1D7317A7D9D331B1586A763E8197BAF60BC2237CB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2892	bootloader.exe
2892	bootloader.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootloader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6116 wrote to memory of 2892	6116	bootloader.exe	90

C:\Users\Admin\AppData\Local\Temp\bootloader.exe
"C:\Users\Admin\AppData\Local\Temp\bootloader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Users\Admin\AppData\Local\Temp\bootloader.exe
  "C:\Users\Admin\AppData\Local\Temp\bootloader.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI61162\_ctypes.pyd
Size 90KB
SHA256 f943df92c70b640b6462312a048d92df8d2e4447129a6d2b75f8f99d6b5d641a
MD5 6ae4a18b7591824366b0b41f24d52d45
SHA1 e22e8abf69c8676b68fe42d9f26c2bd5f731af39
SHA512 f882514fb21191c16dd0e778a26400e3614622df3da9e75da8360def79aeb23d96c820e10351a103ce910272192d39760f271d20cbb3763ef1d8b427b676559c
SSDEEP 1536:tmRGB/RrTODSIrxVJ01Sk72z40KEE3eSUCLpr3jPzDbk9R/EcCwCzzyuaaZlpo:kO27dCSk7e40KEE3eSUCtTPo/P9CfyuU
TLSH
T14B933B14BED1A4B5D3CA00F99276EEE12C395C98132B46F362DAC8D254805F638797DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootloader.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\_MEI61162\bootloader.exe.manifest
Size 1014B
SHA256 514c2cbdfe6432b43484d34fd22c2dd73ca175323e43844ff470bd56104a86eb
MD5 530a1347ac3153d79e526cfbd0434746
SHA1 03604cb8a8f62c52d4e4e3f47dd7850e626c2472
SHA512 5049e616d4571cc119d705aa23f03cf3e8348c747c337e458d67a5d51d2b155ebcfe2139e784c72383d1124a2c992083057783a58995a339c6cb805499f748dd
TLSH
T14A11E100C4C9E862B73241D33365AD49DE59A7BB088C46DEB48D7B2F9B13ED4C253168
MD5 SHA1 SHA512 TLSH

Submit Download

python27.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI61162\python27.dll
Size 2.5MB
SHA256 b5ed923a52fa1bf7f524008f3b393077807cd32ea45aca392065cd8cae0171d6
MD5 9bd072fdd178efc44276b53fbcdc17d6
SHA1 24b7f989b19308ec91bbdd099f7fd6bd3add97eb
SHA512 69f91f83bbd0cef7785029a881278977740ffe26fdc03e19fe8b67a284ff77363d9ae451cf45675447fb01484b4790f0b369867558e10265c5d3c22d42e4efeb
SSDEEP 49152:JANCCC1J7140dU/kNmcE2RBTkmCsEvlyZt0pz+kVPHnfMlHHMS19IzmTfyr+yvMm:TCC/mUTkmCs2IMf5fMpH51yzTp1J
TLSH
T183C59D20B942D031DDEA08F6A2BD5AF65D744D18772B71E3A4E87888C2721F2357D39E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads