c4a09cfc407bd538d125d6faa2b2e6be24f4f0cf913fec5a3de6c4b3d8f39b0a

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c4a09cfc407bd538d125d6faa2b2e6be24f4f0cf913fec5a3de6c4b3d8f39b0a.exe
Size 1.9MB
Sample260810-ee2yba1aka
SHA256 c4a09cfc407bd538d125d6faa2b2e6be24f4f0cf913fec5a3de6c4b3d8f39b0a
MD5 d69fcd9d92d5c5afc8385448e5a4fcc0
SHA1 41bad600d811c3a4e200dc8f734b3aa0f7d41ff3
SHA512 52418cd52614ce9ebc546c3241b3f9704974cab67c72507be706bbdf0e2918900b46477a735736a2e9b7b4f4e68efd20afdab8506fae6f633c63f763d16cf3f8
SSDEEP 24576:FNrq962DWPBsOmeUra9aOcGQ/sgBrgIeV:DqePBnLuOcGQUmgN
TLSH
T11495F690674A8065ED4209F0CD6DC3397E655FD12E19CAF242D0FFF7BAB2B827816246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1968	DirectorSimulator.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4a09cfc407bd538d125d6faa2b2e6be24f4f0cf913fec5a3de6c4b3d8f39b0a.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4532	c4a09cfc407bd538d125d6faa2b2e6be24f4f0cf913fec5a3de6c4b3d8f39b0a.exe
4532	c4a09cfc407bd538d125d6faa2b2e6be24f4f0cf913fec5a3de6c4b3d8f39b0a.exe
4532	c4a09cfc407bd538d125d6faa2b2e6be24f4f0cf913fec5a3de6c4b3d8f39b0a.exe
4532	c4a09cfc407bd538d125d6faa2b2e6be24f4f0cf913fec5a3de6c4b3d8f39b0a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4532	c4a09cfc407bd538d125d6faa2b2e6be24f4f0cf913fec5a3de6c4b3d8f39b0a.exe
4532	c4a09cfc407bd538d125d6faa2b2e6be24f4f0cf913fec5a3de6c4b3d8f39b0a.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 1968	4532	c4a09cfc407bd538d125d6faa2b2e6be24f4f0cf913fec5a3de6c4b3d8f39b0a.exe	90

C:\Users\Admin\AppData\Local\Temp\c4a09cfc407bd538d125d6faa2b2e6be24f4f0cf913fec5a3de6c4b3d8f39b0a.exe
"C:\Users\Admin\AppData\Local\Temp\c4a09cfc407bd538d125d6faa2b2e6be24f4f0cf913fec5a3de6c4b3d8f39b0a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Local\Temp\DirectorSimulator.exe
  C:\Users\Admin\AppData\Local\Temp/DirectorSimulator.exe
  2⤵
  - Executes dropped EXE
  PID:1968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DirectorSimulator.exe

Path C:\Users\Admin\AppData\Local\Temp\DirectorSimulator.exe
Size 651KB
SHA256 955115827eccac495bba1f4d06cb67824ce966c6d35234e675eb330dc8332f8b
MD5 8f44e0fc3db8b0492abea978c997e664
SHA1 c1fde341469df4f33146e02c02c02e11a29dd681
SHA512 ddfcc754b13207c925a88e1098a769027dbd3a4d970e0440e2bda2260c7c0506079ecdfed9379b79a0be3829bc6ed91c43735017d71d64c53b7bbc4b56362b52
SSDEEP 12288:tH744aOD8A0KkxwyHYynltQTaZy/aBrgI:19aOcGQ/sgBrgI
TLSH
T1FCE42964A18DD68AD2828E705B78C17C737F6F6258AE4E11C161B8E8FF7BD843C4A447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download