Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 04:38
Behavioral task
behavioral1
Sample
05a26c16d1e9cabdd23b360194209cef85c0838dbb86f3ac53458b871a3df5cf.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
General
- Target 05a26c16d1e9cabdd23b360194209cef85c0838dbb86f3ac53458b871a3df5cf.exe
- Size 861KB
- Sample260808-e9vgqatvcv
- SHA256 05a26c16d1e9cabdd23b360194209cef85c0838dbb86f3ac53458b871a3df5cf
- MD5 c3c77c6de273fcffeecf6b9dfd78196b
- SHA1 a71097ec9b23f23e4e3bc834824f02732bd75201
- SHA512 673e751be5ca9ddba11f3829a0a38cf4d430b761257f494dfa02ef70cb1e5e1dcf45491aca5270dd3191bd2104e274351788cb421d66faa180a5457084890bb0
- SSDEEP 24576:EEMEmcRWGKIs9cm6Pvk4y2rbCDiO5Uzu8z9l:EApW7L9cvPs4LrbkigUzjzf
- TLSH T13E15236E489AC1A1F2B418708237BAFE56665D02CB8577539C20FCDEF8B46C8F321657
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5676-0-0x0000000000400000-0x00000000005AA000-memory.dmp upx behavioral2/memory/5676-2-0x0000000000400000-0x00000000005AA000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 05a26c16d1e9cabdd23b360194209cef85c0838dbb86f3ac53458b871a3df5cf.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5676 05a26c16d1e9cabdd23b360194209cef85c0838dbb86f3ac53458b871a3df5cf.exe 5676 05a26c16d1e9cabdd23b360194209cef85c0838dbb86f3ac53458b871a3df5cf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05a26c16d1e9cabdd23b360194209cef85c0838dbb86f3ac53458b871a3df5cf.exe"C:\Users\Admin\AppData\Local\Temp\05a26c16d1e9cabdd23b360194209cef85c0838dbb86f3ac53458b871a3df5cf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5676