Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 02:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da97099e309dcae72d333c64e7a01a8828a9987bcf10213c7f1d205be0235326.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
da97099e309dcae72d333c64e7a01a8828a9987bcf10213c7f1d205be0235326.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target da97099e309dcae72d333c64e7a01a8828a9987bcf10213c7f1d205be0235326.exe
- Size 4.2MB
- Sample260809-dcnr8syfrc
- SHA256 da97099e309dcae72d333c64e7a01a8828a9987bcf10213c7f1d205be0235326
- MD5 371f61dfcd6b17659f5e8b4b46077802
- SHA1 b317711e73f8b580f2cd44b112f5d6bf5adf170d
- SHA512 c92c9e46ded6c2bc1c82857104cc5d44f983a9e33bbb38eb39f97dcf2993680d925eb24d6bd60b842397c6df80381adf4634676710238b25e276e13623a88030
- SSDEEP 98304:4h2RR+h0J823qM4xgtAqrkbsPIRcHdnboFLOAkGkzdnEVomFHKnP:42Ch06KzIRcHdnboFLOyomFHKnP
- TLSH T1FD16C011BE994773D46703318DAEBA3D71BEFDA03B25029723C43F6979703920A2A567
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win.ini da97099e309dcae72d333c64e7a01a8828a9987bcf10213c7f1d205be0235326.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da97099e309dcae72d333c64e7a01a8828a9987bcf10213c7f1d205be0235326.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 764 da97099e309dcae72d333c64e7a01a8828a9987bcf10213c7f1d205be0235326.exe 764 da97099e309dcae72d333c64e7a01a8828a9987bcf10213c7f1d205be0235326.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da97099e309dcae72d333c64e7a01a8828a9987bcf10213c7f1d205be0235326.exe"C:\Users\Admin\AppData\Local\Temp\da97099e309dcae72d333c64e7a01a8828a9987bcf10213c7f1d205be0235326.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:764