Analysis
- max time kernel
149s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 15:52
Behavioral task
behavioral1
Sample
1be4a7bb1300324fac48d066268a7dd235e2ebabf0a6ecb26158faa298079c37.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
General
- Target 1be4a7bb1300324fac48d066268a7dd235e2ebabf0a6ecb26158faa298079c37.exe
- Size 12.8MB
- Sample260804-tbfy1adb96
- SHA256 1be4a7bb1300324fac48d066268a7dd235e2ebabf0a6ecb26158faa298079c37
- MD5 afa328a47aec2ecd443d18ea8a436670
- SHA1 566cbc750762d472aa2134207f247c0534f96f68
- SHA512 a16135c3321c750e5c7affb78eccdea9439460052c06bf17e2b00630907c4d2a0d2e8f3b7bd8db9888efd660344a11b8b1b32e6ad38bc0465be6f7f1bacf5ece
- SSDEEP 196608:lAL01znozxwXKn2cKbPkGA/cAFAHFxXUxEu+fhMSj8aW24LA31EMf:lDRnfXn8YAFAHFMEP2Sj83hU
- TLSH T122D633E59B5580C3F54C8B39305DBF6439B246361FCA86CB676EE82DF822500968EC5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2660-0-0x0000000000090000-0x00000000024A7000-memory.dmp upx behavioral2/memory/2660-2-0x0000000000090000-0x00000000024A7000-memory.dmp upx behavioral2/memory/2660-3-0x0000000000090000-0x00000000024A7000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1be4a7bb1300324fac48d066268a7dd235e2ebabf0a6ecb26158faa298079c37.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2660 1be4a7bb1300324fac48d066268a7dd235e2ebabf0a6ecb26158faa298079c37.exe 2660 1be4a7bb1300324fac48d066268a7dd235e2ebabf0a6ecb26158faa298079c37.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2660 1be4a7bb1300324fac48d066268a7dd235e2ebabf0a6ecb26158faa298079c37.exe 2660 1be4a7bb1300324fac48d066268a7dd235e2ebabf0a6ecb26158faa298079c37.exe 2660 1be4a7bb1300324fac48d066268a7dd235e2ebabf0a6ecb26158faa298079c37.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1be4a7bb1300324fac48d066268a7dd235e2ebabf0a6ecb26158faa298079c37.exe"C:\Users\Admin\AppData\Local\Temp\1be4a7bb1300324fac48d066268a7dd235e2ebabf0a6ecb26158faa298079c37.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2660