f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4.exe
Size 88KB
Sample260804-spkzfa1tbx
SHA256 f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4
MD5 d28e5a289c90af5240a74ed718bbdba1
SHA1 b3d371eb80dc43c94d8901f26ea8f72f40b304bf
SHA512 b835d3511d01d5adb7c9595cf96d559ae362c10b6b65118ff90c506a2e19909c05ec059063b6cebeaf0f86e6ad2338ac796485a31dc148fc94cdb6e3faeb016e
SSDEEP 1536:h+gisi/OTW1bk3FwErVvHcT3BignpwLsO9NXw6dcz:hIZ1bk1FVvHcTBO4O9fcz
TLSH
T19B936D0594129237E46344F5A6BA4EBDA17C5BE133822DDBC389FC254B35CE279B106F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1412	bot1.exe
3600	bot1.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5856 set thread context of 1096	5856	f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4.exe	90
PID 1412 set thread context of 3600	1412	bot1.exe	91

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1096-16-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1096-11-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/1096-10-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system\bot1.exe	f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4.exe
File opened for modification	C:\Windows\system\bot1.exe	f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4.exe
File opened for modification	C:\Windows\system\RCX550C.tmp	f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bot1.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 1412	5856	f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4.exe	89
PID 5856 wrote to memory of 1096	5856	f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4.exe	90
PID 5856 wrote to memory of 1096	5856	f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4.exe	90
PID 5856 wrote to memory of 1096	5856	f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4.exe	90
PID 5856 wrote to memory of 1096	5856	f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4.exe	90
PID 1412 wrote to memory of 3600	1412	bot1.exe	91
PID 1412 wrote to memory of 3600	1412	bot1.exe	91
PID 1412 wrote to memory of 3600	1412	bot1.exe	91
PID 1412 wrote to memory of 3600	1412	bot1.exe	91

C:\Users\Admin\AppData\Local\Temp\f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4.exe
"C:\Users\Admin\AppData\Local\Temp\f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\system\bot1.exe
  "C:\Windows\system\bot1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\system\bot1.exe
    C:\Windows\system\bot1.exe
    3⤵
    - Executes dropped EXE
    PID:3600
- C:\Users\Admin\AppData\Local\Temp\f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4.exe
  "C:\Users\Admin\AppData\Local\Temp\f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4.exe" -cure -offset=90112 -rcline="C:\Users\Admin\AppData\Local\Temp\f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4.exe"
  2⤵
  PID:1096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot1.exe

Path C:\Windows\System\bot1.exe
Size 88KB
SHA256 f0044f13be1dcfadb49178b3556d60385b978c84875fa3ab949556e4811b19c4
MD5 d28e5a289c90af5240a74ed718bbdba1
SHA1 b3d371eb80dc43c94d8901f26ea8f72f40b304bf
SHA512 b835d3511d01d5adb7c9595cf96d559ae362c10b6b65118ff90c506a2e19909c05ec059063b6cebeaf0f86e6ad2338ac796485a31dc148fc94cdb6e3faeb016e
SSDEEP 1536:h+gisi/OTW1bk3FwErVvHcT3BignpwLsO9NXw6dcz:hIZ1bk1FVvHcTBO4O9fcz
TLSH
T19B936D0594129237E46344F5A6BA4EBDA17C5BE133822DDBC389FC254B35CE279B106F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-16-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1096-11-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1096-10-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5856-0-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/5856-18-0x0000000000400000-0x0000000000418000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads