4c26e224c5a2a050df2850a6efd9cf1f3fc98b67f4a31a3219692a4de36db2ba

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 10:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c26e224c5a2a050df2850a6efd9cf1f3fc98b67f4a31a3219692a4de36db2ba.dll
Size 5.4MB
Sample260809-myf4ysdq2w
SHA256 4c26e224c5a2a050df2850a6efd9cf1f3fc98b67f4a31a3219692a4de36db2ba
MD5 fcadb7c4ccda5c43ae9e2bebcd471272
SHA1 2a88b07de027320f13a4c0fd3650967bd7b9e484
SHA512 5e3afeac6a53cdaba2dd7807d64d2a750a421200447f5bade40170444ef2941efbd027fd65f6fe2f0199d3de56116a27063991914cf4a2f04d7e3ee9876bf36e
SSDEEP 98304:kqXykdrxC1kaPuyQfpjM/7ZbPZN13MpiRtrKieE5ZevkJpr:kyZ3aP8pY/7ZBPVKpKevWp
TLSH
T1E2461213B941C0F2E16D1A7015E7773AAF7A87920A39CE83A7D4DDB92C732539B2910D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2240	rundll32.exe
2240	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2240	rundll32.exe
2240	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2240	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 2240	3340	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c26e224c5a2a050df2850a6efd9cf1f3fc98b67f4a31a3219692a4de36db2ba.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c26e224c5a2a050df2850a6efd9cf1f3fc98b67f4a31a3219692a4de36db2ba.dll,#1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2EECore.3.3.9.dll

Path C:\Users\Admin\AppData\Local\Temp\E2EECore.3.3.9.dll
Size 10.6MB
SHA256 c58e066a293ff260037487d37e37bf3d890c16383d817c7573dab51c514cbd00
MD5 50c266e46ccf9bc8956279f78d51f205
SHA1 0ba5b98a91a9a019cd9b87cf01796c65ee6a0839
SHA512 7350a82820faeba3172fad3d87b04c6a2967b797a321a78a53e7156c37fed4661a66d2f78e2f3ddbcbc0d10a56f5d761f7eb761f05d2841568b34841c17e0d37
SSDEEP 196608:tWqOnbKxQggWXn3M4ggbT6xY8AojRGxhGwipOW2QaNuCV7PQi:tmnbKSggW7bT6xBAYg6vpOW2Qa8eQi
TLSH
T1D0B68D00FB4381A2E98E01B55176A73E45397E6403291EE7F35C3F6A6E316C23B3665E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iext1.fnr.bbs.125.la

Path C:\Users\Admin\AppData\Local\Temp\iext1.fnr.bbs.125.la
Size 743KB
SHA256 6b0674afddd9634e4ca39b4031c54addd278de1e8e6cbdf5c725bd41426e3a9a
MD5 e2a2438c0fe8b467ac307aba02a2d351
SHA1 7781a54fb5c59990b016dff83423ddc1f612bb0f
SHA512 39c350062380735001f1705fd84c9b666dedb06b0f9489719380747220fa09ba8be7b29decae707e89d562704bbf8c4fcb3d9a3c88414364da77652474a81bb1
SSDEEP 12288:NpXaOsxd7/UtP9nmoWHzXf6GayfAK8f9SamacBg3DT2Y538ydq8pVNO32a:NpXaOs7/E9nmoW2GaNDNfugzT738p8l6
TLSH
T1B1F49D12B94280BBE4AD00B1456F6F6F4A2D9B114BB5AAC777D41DA94F306C0BB3E317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download