b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020.exe
Size 3.8MB
Sample260805-rcaghattfx
SHA256 b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020
MD5 6d51d6d69b476955d8b54adfd581f939
SHA1 2077a6204f6ac079f717606f65663698cc2463f2
SHA512 8713d958d3d0ec5bb76b25b4bfb8fee7c7ac4a6ed27801e3684a454b0efef3acbbd733c7c14e325f4ede66bd180916e46387296639dd278e4f0ed2d7325e8398
SSDEEP 49152:C6BNc0AaiIcHa0kKOu8HfRNshU9yTBGN/TmGNn3Fj:tTc0AaiFyXwUEBGNLmON
TLSH
T1C416AF12F38281BDC442263035B97377563C66E25B1E9AEFB3C4BD2C6D713814BA764A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3312	b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
864	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6096	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6096	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020.exe
Token: SeDebugPrivilege	3312	b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020.exe
Token: SeDebugPrivilege	3312	b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2412	b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020.exe
2412	b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020.exe
3312	b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020.exe
3312	b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 864	2412	b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020.exe	89
PID 864 wrote to memory of 6096	864	cmd.exe	91
PID 864 wrote to memory of 3312	864	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020.exe
"C:\Users\Admin\AppData\Local\Temp\b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Restart.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6096
- - C:\Users\Admin\AppData\Local\Temp\b63509f70f9139b21db257c100df11af54dabbc011274e92c0430c5275442020.exe
    "C:\Users\Admin\AppData\Local\Temp\B63509~1.EXE"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ExuiKrnln_Win32.lib

Path C:\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32.lib
Size 2.6MB
SHA256 dafb7f5dbc3f678345872846ee45d9757cfeaf9e95065c176ece87cd0cbc23e7
MD5 bd2f33c9a3b45f399513d9e5b4bec73e
SHA1 acb7e1e6e33cf53323bbc32b43b0de55b5187c0b
SHA512 da64e08414919111683537a2abfb1ee3bfa5408c403de37504a637b4e58d37c3e74d60aa2a5ed6e2f1fb18f55f7418a7467206ad4cc79aad38718512ba5265d4
SSDEEP 49152:eIcHa0kKOu8HfRNshU9yTBGN/TmGNn3F:eFyXwUEBGNLmO
TLSH
T1F8C58E11F39681FCD8827170357877F7113D35F65B1EA9EFB2C4392CAAB11814AA7A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Restart.bat

Path C:\Users\Admin\AppData\Local\Temp\Restart.bat
Size 113B
SHA256 6804a70ce0b77ef392c6ad765261913eb0199d7ffe091e5710cf83acbdada852
MD5 2e9fc0ad19514b35515126b15add6e7a
SHA1 9b6f906c35b2913cf9a7cba25b5d6c30155a387e
SHA512 648ef3760e646f60a82db2183bfd1ae36a4a782a0ba5ac6c7051720fe558302e5bb3d49bf7ef9cc241b436f5512b804d3f74907dd9fc1d58883faa6d548eda87
TLSH
T129B02203A800C80C0C000A8300FE2B0CE0AEC80C2B0AEAE00E20CC282F23800F0CA200
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2412-0-0x0000000000400000-0x0000000000810000-memory.dmp

Download

memory/2412-3-0x00000000004D3000-0x00000000004D4000-memory.dmp

Download

memory/2412-2-0x0000000000A50000-0x0000000000A6A000-memory.dmp

Download

memory/2412-12-0x0000000000400000-0x0000000000810000-memory.dmp

Download

memory/2412-11-0x0000000000A50000-0x0000000000A6A000-memory.dmp

Download

memory/2412-10-0x0000000000400000-0x0000000000810000-memory.dmp

Download

memory/3312-14-0x0000000000400000-0x0000000000810000-memory.dmp

Download

memory/3312-18-0x0000000000400000-0x0000000000810000-memory.dmp

Download

memory/3312-19-0x0000000000400000-0x0000000000810000-memory.dmp

Download

memory/3312-20-0x0000000000400000-0x0000000000810000-memory.dmp

Download

memory/3312-21-0x0000000000400000-0x0000000000810000-memory.dmp

Download

memory/3312-22-0x0000000000400000-0x0000000000810000-memory.dmp

Download

memory/3312-23-0x0000000000400000-0x0000000000810000-memory.dmp

Download

memory/3312-24-0x0000000000400000-0x0000000000810000-memory.dmp

Download

memory/3312-25-0x0000000000400000-0x0000000000810000-memory.dmp

Download

memory/3312-26-0x0000000000400000-0x0000000000810000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads