Analysis
- user interaction
yes - max time kernel
74s - max time network
71s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
08/08/2026, 06:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
skeet.zip
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
2 signatures
150 seconds
General
- Target skeet.zip
- Size 3.6MB
- Sample260808-hppbrascmg
- SHA256 9ef0138b7bdf677007d0895f086dcdfd093877bdf1fc46c05cef6928c3c55b21
- MD5 e513b9489a29ab333af3068709259a7b
- SHA1 74da58de8443fdace089d07000c998b52717f5eb
- SHA512 505b3ccd7d93814c119ed2968a9b251bb4910c569e74d34982120d4dab60babf8a014d17964f73c758d0a7a8ded7c7558bf66c2a5cb7c989b8ca6814e42bd8ad
- SSDEEP 98304:IfBXdbSJ/yl/qwoEtjeDhzyYi+FRBQApoXCvB3dz3+v:CqKA0Yi+RBQS53dSv
- TLSH T1540633B4875811ACD62AE8F6384B1B3FC13CA91DDA26A3CD4172907B277FCA6758471C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language steam.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe 1864 steam.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\skeet.zip1⤵PID:4732
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2164
-
C:\Users\Admin\Desktop\steam.exe"C:\Users\Admin\Desktop\steam.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1864