2544c19ef739f92150f0b304dc8091f8d666d704ec1a7a067eff6a6e8f2034a6

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
q3ONeHNcmZyCLUQwnKsJp2q5ETXM.exe
Size 29.1MB
Sample260808-ac8wmaaf47
SHA256 2544c19ef739f92150f0b304dc8091f8d666d704ec1a7a067eff6a6e8f2034a6
MD5 12d851ae555dad9ea8ab1b5f058c4126
SHA1 8e775e4ccbc19a4538251a2f82d45dbd336664aa
SHA512 3b31f9e12eec7b4ad8c20390d3bfb6acff82ec37e0b410dcf16104a7d3be79ebbccaae335b720826c92d13fc6e3d9182ce28d443927427129e9664ccb846a73b
SSDEEP 786432:57k/A8NfROcoLfKrq+7VYPRRlXhFvdSsdULm93x9:S/tAjK57VYPzlv19rH
TLSH
T15A6733DF298B40F9D9C114B5671F2BE713F3D1D94A928C3A79C13188B1A3FBA602B591
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3860	q3ONeHNcmZyCLUQwnKsJp2q5ETXM.exe
3860	q3ONeHNcmZyCLUQwnKsJp2q5ETXM.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	q3ONeHNcmZyCLUQwnKsJp2q5ETXM.exe

C:\Users\Admin\AppData\Local\Temp\q3ONeHNcmZyCLUQwnKsJp2q5ETXM.exe
"C:\Users\Admin\AppData\Local\Temp\q3ONeHNcmZyCLUQwnKsJp2q5ETXM.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:3860

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3860-0-0x0000000000190000-0x0000000003988000-memory.dmp

Download

memory/3860-1-0x0000000000190000-0x0000000003988000-memory.dmp