ba684e93e8403967edccc30f1f14822ae7f7a9c377483db7f8534fd1491759b0

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 11:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ba684e93e8403967edccc30f1f14822ae7f7a9c377483db7f8534fd1491759b0.exe
Size 8.0MB
Sample260809-n1p1baxcja
SHA256 ba684e93e8403967edccc30f1f14822ae7f7a9c377483db7f8534fd1491759b0
MD5 8ea783baf198d60438eebfe188f50f0b
SHA1 257e92690a9b7ba361d358ff42bba23a49b92a75
SHA512 fe144da3782cae71f03501f55eeb767cb2688256fcaa5fd9a6deb1aae3a766c91ce908f8d260a6b3690c0f1dad8384fabba69fbb0af10acf6342c176d26b1718
SSDEEP 98304:M4HQ2xHuqvugECulUD+gKOBMYQ1jlnwCizb867hTJnR/nkBHcMZBQ8khS8u+C40j:uClFEjT/SLQp+CGIulFk556hSaWzKu1
TLSH
T1BB86232162AA412BFCB2127078747652057DFE718BF168CB326CB45AA73E5C07E64B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
680	ESETOnlineScannerBTS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba684e93e8403967edccc30f1f14822ae7f7a9c377483db7f8534fd1491759b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ESETOnlineScannerBTS.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 680	3412	ba684e93e8403967edccc30f1f14822ae7f7a9c377483db7f8534fd1491759b0.exe	89

C:\Users\Admin\AppData\Local\Temp\ba684e93e8403967edccc30f1f14822ae7f7a9c377483db7f8534fd1491759b0.exe
"C:\Users\Admin\AppData\Local\Temp\ba684e93e8403967edccc30f1f14822ae7f7a9c377483db7f8534fd1491759b0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Users\Admin\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScannerBTS.exe
  "C:\Users\Admin\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScannerBTS.exe" --bts-container 3412 "C:\Users\Admin\AppData\Local\Temp\ba684e93e8403967edccc30f1f14822ae7f7a9c377483db7f8534fd1491759b0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ESETOnlineScannerBTS.exe

Path C:\Users\Admin\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScannerBTS.exe
Size 2.1MB
SHA256 034b2f4c418f331b849219f154c602108ec324b6e80398dcef701bdc1a1c0caa
MD5 39bee63eb96f24b8b5b5e176a2443900
SHA1 0be4f7ec4ca3faabd5d0b6651b5f3b1dba822cc9
SHA512 92b89d7c72263456d92e3576592852214c3804e8eecff2f41873d406e4aa4ab5c120a95c11756f8fd9e282a1e9d8ee86f374245403488e6f75f4f2e51819de39
SSDEEP 49152:sezoGaU2h/O6YnnGykhGBkPQEil0C6NtAsLum649wFMBRya:sezfHnGyiGBiS0C68Hmn
TLSH
T1B5A56B32B245C022E4B225B2583CDE7B842DBD350B2154C7E7E0BE6E68B55C3663AF57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download