Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 09:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe
- Size 250KB
- Sample260807-lyh3wascph
- SHA256 d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953
- MD5 9646eb74cc77913741276445dbafd4c8
- SHA1 5376e9651f10a51c05e2aa1235ba834d8d944271
- SHA512 08ebe8f9f26f24b76b2ee9d2b214939ea0e61bfcd733788edb6a75fc8bca05d8b41a248e9fc3e68d9a04ca95e966ecfb153a4c1896d6eab16067d6007e0fdd3b
- SSDEEP 6144:UbK18ErWn1y3Nqwjek6Oc++fi+yXVfJY1Fb2:UbK18ErWn1y3Nqwjld+OVfCC
- TLSH T11F446A09B76940F2E057C139CAD29786F6B278562B7193CF5321873A5F237E0993E362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1824 d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe - Drops file in Program Files directory 32 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA4BD.tmp d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA3BF.tmp d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA3DF.tmp d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA4BE.tmp d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXA899.tmp d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX99C7.tmp d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9B32.tmp d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX9B71.tmp d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXA8B9.tmp d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX9997.tmp d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA430.tmp d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA50D.tmp d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9AD3.tmp d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXA8C9.tmp d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXA41F.tmp d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX9AA3.tmp d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5472 wrote to memory of 1824 5472 d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe"C:\Users\Admin\AppData\Local\Temp\d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe"C:\Users\Admin\AppData\Local\Temp\d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe"2⤵
- Executes dropped EXE
PID:1824
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 554KB
- SHA256 2c3d06d10914c11dee9ee3428e8b572366b399c8213545e2a380db9bde585c80
- MD5 dfe4ce6366a52077a591158b38fcf46a
- SHA1 2c1a81adcd84a8fa9c51f160c4bbca5ca77d69f2
- SHA512 1b4ed1df805554890250829765545ff5806755988f493930503095c5c1c74e8ec5abb0a042c41bff68ecbf68306cef3329f10fd4ffec623e953098b8d8fde370
- SSDEEP 6144:UjQLO76tlVr1Il5HlrJHU7kfLeeHVlK8SQBJ9LBKJwgdAmKa5rL:UkS86nHrUA9HVlK8SQBJ9t4f15rL
- TLSH T197C49E41F7D847E9E07AC534CA428646EAB178960B61F6DF03A0427A2F376E54F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe
- Size 1.6MB
- SHA256 1bc50df8f2879fb4439c0b977b61b6233e3626cc6ad0e236a23527c24d4bf7cf
- MD5 ca5142ecd372d0aa216405beaf9ee74d
- SHA1 e079aa637b8ab23a4738b1f3ec3653264e538770
- SHA512 0f011f69799c2dd42005ca867535c066a29314288a36e6f8ed39c56a601be451b62ceca44b4a5282215bed95689cbf3c7b9ec7e8f7a2999b7ae89c175a6e5502
- SSDEEP 24576:anh1d46If99L9KA4uaiXJVB6HveuTJb9HxeQuJXlPnyF4mfHU9YawsN:S4hoNiZVB6PeuT5lxeHX04mfHI
- TLSH T1DE756A03B6D901E8E06DD2B8C7568122EAB2BC450B34A6DF0790B75A1F77EE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
- Size 1.4MB
- SHA256 f5f0412f1fdc11f9793a74ac30ec9e692ffd2a1e2c60dd4411d2862a30c73a20
- MD5 2162bdd91a2156418abaf00942f78ce9
- SHA1 378a378ef84a45d52d82ebb91afbcfe8185e7d54
- SHA512 a3d094da74d82c67907b42881d91d03a347f62f4e7861ff62ec08f85986facca9463aab2189d32942f0740c3cc8adf44287724e8b057779a4c592c6215b1486b
- SSDEEP 24576:keZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:4Y2fF8FhmS86IUJWQn+6h27d6
- TLSH T1BA657C03F69900E8E059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F77EE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
- Size 4.6MB
- SHA256 c86bc4c58a72524246c7e116cd0a90feb9085043e59f7a9b48ac752827310bf7
- MD5 70319da4b68b457f4de2d995d6b43066
- SHA1 4ccb4218022e7173f0af75fa54b4b6cd5762d2d3
- SHA512 a118aee83f44ca21fa28cedb3bb74a18903a8999849c6e37e18c01b4839a7d7a821a782a3b1cc1b8300913d8c3358843304876132951a4c9c72a06c2559e5bbf
- SSDEEP 49152:xX6YRJwudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:xxIijnUdYd+RaAj
- TLSH T1AF264803B28984D4D049C074CE1AD232AB617C9947F161EF36D4BBEA3A73AD47A3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e59985e.tmp
- Size 2.8MB
- SHA256 347aabd0f9d2612664bcd17b63321550d64669df9f113e6545b8ad2a984d68f1
- MD5 e2302ea57eaafc2112426db01d886e19
- SHA1 ea54d55682d42f55fdf91ee9f682054a9fa18815
- SHA512 a3e85871dbdc55fbd37bb56530986e095b6ed1b18ac3132fb5e3dae9e3a4d05dd796ef62f821442648d1e9ce1ca2473a22ee8c5745ab55e70cb275e49adb3e24
- SSDEEP 49152:jY2fF8FhmS86IUJWQn+6h27dRY2fF8FhmS86IUJWQn+6h27d6:jbOjjstLbOjjsts
- TLSH T181D57B03B79900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\d41af9622d4cdab98efdb8b485898095dd34bd96dd06d625d5d30f1ad825f953.exe
- Size 218KB
- SHA256 5e8a0cf758ad911e281d65c1b6046678ae4a12300c1c7c0e6fc1ad7f47f8cf8a
- MD5 b7c313930143bde751783406fc168ed6
- SHA1 43a4f768e44c9109235fe394e9a631f4c12a45c2
- SHA512 94be751ad2881a92840e4411473d5a6a9845f3333a6c45b3d27a89940a70fcfed838d98c721bd883bc96a0ed74d789c4777101411fa16f93580a190c2252e9ce
- SSDEEP 6144:CK18ErWn1y3Nqwjek6Oc++fi+yXVfJY1Fb2:CK18ErWn1y3Nqwjld+OVfCC
- TLSH T18B245A49B7A844F5E0ABC13DC9928746F2B274594B7147CF1361873A9F237E1A93E322
- MD5 SHA1 SHA512 SSDEEP TLSH