Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 15:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42408ee8e5ac22f90451fd3260c86e52f0e3e03c6081afc7d642d627abe2cf84.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
42408ee8e5ac22f90451fd3260c86e52f0e3e03c6081afc7d642d627abe2cf84.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 42408ee8e5ac22f90451fd3260c86e52f0e3e03c6081afc7d642d627abe2cf84.exe
- Size 97KB
- Sample260810-snar3sbr4v
- SHA256 42408ee8e5ac22f90451fd3260c86e52f0e3e03c6081afc7d642d627abe2cf84
- MD5 d3f254445545f72329eb8a31376cbf85
- SHA1 27ad0d5db4ae7b8d8ac2fe7937a6d5f8a1b9cee6
- SHA512 d25c17715d62d8c86ff751efab8419e83490bb9df148cd036d1bfbb8efff97360c37d4c659a2cb019d94f86e75fe2ddf79f5e3f622135864aed8c19686e39b98
- SSDEEP 1536:/N6ERbGQUgUoapFKZ10X+y/zWMwLQ/A1o8h5z+UKhXwaQldrd0bJrPq7S7G:/N6ER6eUoabKzWh/aMwAQz+rrK
- TLSH T16FA30122A37852A1C4FD87721B732354CA74BEC15823EE7F3BF5708E7A1A2985141F92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral2/memory/4608-2-0x0000000004BB0000-0x0000000004BC6000-memory.dmp ConfuserEx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42408ee8e5ac22f90451fd3260c86e52f0e3e03c6081afc7d642d627abe2cf84.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4608 42408ee8e5ac22f90451fd3260c86e52f0e3e03c6081afc7d642d627abe2cf84.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42408ee8e5ac22f90451fd3260c86e52f0e3e03c6081afc7d642d627abe2cf84.exe"C:\Users\Admin\AppData\Local\Temp\42408ee8e5ac22f90451fd3260c86e52f0e3e03c6081afc7d642d627abe2cf84.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4608