42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe
Size 314KB
Sample260812-kvn92sshjf
SHA256 42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02
MD5 aa8cf0a65f86e7093ed8e5c54727355e
SHA1 cd31af938267b28648eaa2f4b90de3ae8b43c41e
SHA512 e6c2543bdbaaf45cf4e4d74e8b102630906846a4b0782eb3493a8cd76f274a46bd4cbc577df41e2070c9dfe2597beabef7de54fd400ad02a9cc84ff09f1e5ca9
SSDEEP 6144:V7WOPFZ+eiqIjz2F1Bsy1STBDtvx3Ejg5:V7nb+eVIW7B9STNZx0jg5
TLSH
T1D1646C06B4C184E2D42244715CE7B7705A7FA93F1E219ECFAF871B3509B5390A632A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4276	42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX4012.tmp	42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX4023.tmp	42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 4276	2180	42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe	86

C:\Users\Admin\AppData\Local\Temp\42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe
"C:\Users\Admin\AppData\Local\Temp\42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe
  "C:\Users\Admin\AppData\Local\Temp\42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 586KB
SHA256 0aeb2c73561b3abc10f26957ed7680ad105626e96abed9ee63a12f21d9ac7810
MD5 0799d9c4ed0462d17184bcd8a135fa22
SHA1 bcb86fb3434ce83ba74a295a21e76d7737e8137c
SHA512 cb86ec4ad86627889e19097c1751078347f59cbe8368bedcfe06677362a28268397d7416300689a3c2edbb41aeea5fff8c17dc48b254fea71a744a1fffad350d
SSDEEP 6144:VxQLO76tlVr1Il5HlrJHU7kfLeeHVlK8SQBJ9LBKJwgdAmKa5rL:V+S86nHrUA9HVlK8SQBJ9t4f15rL
TLSH
T19AD46C41B2D447E4E06AC5348E43A241DA7A789B0F60AEDF0F9102792F776E55F3A31E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe

Path C:\Users\Admin\AppData\Local\Temp\42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe
Size 250KB
SHA256 dbb21632418ebd5ea8cddfc47256a0d6ce07e4048029decc59c222d6454f0d97
MD5 fa4f5abbc18cf12f720d87f7ae387ccf
SHA1 22cb4e9a6627111c25c83772d0248894151d990e
SHA512 41e4f0c3b42ac2271c1ccafdbd67c9013b5e02e177e5d7fe1a6a31a9182b3b33e993b2e176633e9a5c5665378c6640cd969d61cb3e794c52811a381e7f348790
SSDEEP 3072:BcWOPBeyRIc+nei6VHIjz6FMhCws6Ys5k1tzpkZAK4iTBfrcN4gWvxhtoVjtjgGu:eWOPFZ+eiqIjz2F1Bsy1STBDtvx3Ejg5
TLSH
T116446B19B1C084F2C42254315CE7BB755A6FB93F0F209DCB6F8B2B390A652D16A3265F
MD5 SHA1 SHA512 SSDEEP TLSH