3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe
Size 608KB
Sample260810-rte4bagg74
SHA256 3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09
MD5 7d9c626d3a9cba22a33944fbfe985b7a
SHA1 a0fb6244a9ba3f8790e69f1548e09305b45e6318
SHA512 fc05d7e019a28217ad6005a2ef1474d146ee15d6bfb6c66152d614f306af96ea5ed765ef90ff7a27997f831e1af38f7e346ea4044c2579e0fa88a79cbef8d312
SSDEEP 12288:gX42de5lr9UsPD1a7xL9ZKQivFj+x++mECjXOszICWnxJidSKi:C42de5lr9UgJcPZKQi5+mECjFzIC8jo4
TLSH
T1BAD42351B39484E7D2B209B00E216B375523DF374EAE7B1B8B60796CBD766867C0CB42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1316	3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1316	3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe
1756	3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1316	3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2468	1316	3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe	89
PID 1316 wrote to memory of 1756	1316	3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe	90
PID 1316 wrote to memory of 1756	1316	3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe	90
PID 1756 wrote to memory of 4904	1756	3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe	95

C:\Users\Admin\AppData\Local\Temp\3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe
"C:\Users\Admin\AppData\Local\Temp\3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Users\Admin\AppData\Local\Temp\3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe
  "C:\Users\Admin\AppData\Local\Temp\3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe"
  2⤵
  PID:2468
- C:\Users\Admin\AppData\Local\Temp\3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe
  "C:\Users\Admin\AppData\Local\Temp\3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Users\Admin\AppData\Local\Temp\3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe
    "C:\Users\Admin\AppData\Local\Temp\3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09.exe"
    3⤵
    PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu438E.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1316-24-0x00000000746F5000-0x00000000746F6000-memory.dmp

Download

memory/1756-25-0x00000000779F8000-0x00000000779F9000-memory.dmp

Download

memory/1756-26-0x0000000077A99000-0x0000000077A9A000-memory.dmp

Download

memory/1756-27-0x0000000077A15000-0x0000000077A16000-memory.dmp

Download

memory/1756-28-0x0000000000460000-0x00000000016B4000-memory.dmp

Download

memory/1756-29-0x0000000077A99000-0x0000000077A9A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads