36f66c6d3feaf813bdda9fe2280c9007810eeb9ca6be34f545c52f1fa23c69ee

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
36f66c6d3feaf813bdda9fe2280c9007810eeb9ca6be34f545c52f1fa23c69ee.exe
Size 3.1MB
Sample260805-bd3xfabd26
SHA256 36f66c6d3feaf813bdda9fe2280c9007810eeb9ca6be34f545c52f1fa23c69ee
MD5 81208a6b721b925215db266813dd8cc5
SHA1 587ceb67564a27b44acaaf016e149ac563a2d88e
SHA512 2e87f0f95db604f4dc7e6d15004329dd8206c81d39facce813d985d9201fb9072820ef6538923f129fe771d9363342f35d5f5ed436fa2906bae7a1ed40911eb8
SSDEEP 98304:gIUnEJ8oGaAR9BpwmeNhagy2j6lJsUtcCUASyLTxR2BiXkC:kEXA/lef16lJsU2CUASyLTxRs
TLSH
T12EE56C113975C867C332A232568AFF7AB16FD12B0B6944D326CCBD3CF5A1DD2892542B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\vjsc.dll	36f66c6d3feaf813bdda9fe2280c9007810eeb9ca6be34f545c52f1fa23c69ee.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	36f66c6d3feaf813bdda9fe2280c9007810eeb9ca6be34f545c52f1fa23c69ee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	36f66c6d3feaf813bdda9fe2280c9007810eeb9ca6be34f545c52f1fa23c69ee.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3988	36f66c6d3feaf813bdda9fe2280c9007810eeb9ca6be34f545c52f1fa23c69ee.exe
5032	36f66c6d3feaf813bdda9fe2280c9007810eeb9ca6be34f545c52f1fa23c69ee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 5032	3988	36f66c6d3feaf813bdda9fe2280c9007810eeb9ca6be34f545c52f1fa23c69ee.exe	89

C:\Users\Admin\AppData\Local\Temp\36f66c6d3feaf813bdda9fe2280c9007810eeb9ca6be34f545c52f1fa23c69ee.exe
"C:\Users\Admin\AppData\Local\Temp\36f66c6d3feaf813bdda9fe2280c9007810eeb9ca6be34f545c52f1fa23c69ee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Users\Admin\AppData\Local\Temp\36f66c6d3feaf813bdda9fe2280c9007810eeb9ca6be34f545c52f1fa23c69ee.exe
  C:\Users\Admin\AppData\Local\Temp\36f66c6d3feaf813bdda9fe2280c9007810eeb9ca6be34f545c52f1fa23c69ee.exe 47043E0458045104770461047604770458044504600469046D046A0458044504740474044004650470046504580456046B04650469046D046A04630458046004620476046C046004760470046A04600469046E045804630451044A046F04480435045B043D04370456044E047E04580457044A043504600435044D0457043504560431043304--a\k\`
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads