42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe
Size 314KB
Sample260812-kvn92sshjf
SHA256 42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02
MD5 aa8cf0a65f86e7093ed8e5c54727355e
SHA1 cd31af938267b28648eaa2f4b90de3ae8b43c41e
SHA512 e6c2543bdbaaf45cf4e4d74e8b102630906846a4b0782eb3493a8cd76f274a46bd4cbc577df41e2070c9dfe2597beabef7de54fd400ad02a9cc84ff09f1e5ca9
SSDEEP 6144:V7WOPFZ+eiqIjz2F1Bsy1STBDtvx3Ejg5:V7nb+eVIW7B9STNZx0jg5
TLSH
T1D1646C06B4C184E2D42244715CE7B7705A7FA93F1E219ECFAF871B3509B5390A632A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4756	42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 4756	2600	42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe	88

C:\Users\Admin\AppData\Local\Temp\42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe
"C:\Users\Admin\AppData\Local\Temp\42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe
  "C:\Users\Admin\AppData\Local\Temp\42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e58f392.tmp

Path C:\Users\Admin\AppData\Local\Temp\0e58f392.tmp
Size 5.2MB
SHA256 1f93c6d172af881a39e7238df0b54cdb5fbc58a94e1f1f745c183f58112307dd
MD5 b24550037f4d77e23e17b832f7a93859
SHA1 cf60e573e70e3f21561038d85c00de89216da50d
SHA512 c5ecf1b7c1e8715b3800922bb0a8c9e99a861f89a3ebe991369554b3bb5fdd531eef508aba7fa9119ecb4688320a59eb7bfac394b6573608d6ff3b8f4d87ad15
SSDEEP 49152:W6Q3sQmSoFCuQrb/TWvO90d7HjmAFd4A64nsfJzDtlod5Pqe8tOCED4PgasvccmI:0wFCu6jHICG+D4y9kULnTH
TLSH
T116468C03BC9560E8C6EED230897A4252B7717C890B3177D32B64B6B92E737D85E39394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe

Path C:\Users\Admin\AppData\Local\Temp\42ece66ccbf507d601b586ec00eed1dc6e257867d01a2f7eae17589143890c02.exe
Size 250KB
SHA256 dbb21632418ebd5ea8cddfc47256a0d6ce07e4048029decc59c222d6454f0d97
MD5 fa4f5abbc18cf12f720d87f7ae387ccf
SHA1 22cb4e9a6627111c25c83772d0248894151d990e
SHA512 41e4f0c3b42ac2271c1ccafdbd67c9013b5e02e177e5d7fe1a6a31a9182b3b33e993b2e176633e9a5c5665378c6640cd969d61cb3e794c52811a381e7f348790
SSDEEP 3072:BcWOPBeyRIc+nei6VHIjz6FMhCws6Ys5k1tzpkZAK4iTBfrcN4gWvxhtoVjtjgGu:eWOPFZ+eiqIjz2F1Bsy1STBDtvx3Ejg5
TLSH
T116446B19B1C084F2C42254315CE7BB755A6FB93F0F209DCB6F8B2B390A652D16A3265F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXF46E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXF46E.tmp
Size 64KB
SHA256 3133c96800b7ff3b8f514372bb9debe52f7adbcf89b83c6260d370ad73603fad
MD5 a3f881f64f0053d5bcd59723afee8f97
SHA1 b1114b352900c6ff15e26f24cc22a0efee49405e
SHA512 5e063ef66119df0c31568a68a071c4a9039950eb2dd21c141fd9589cd3448f4505ec14022c3293268bafc4776ef2e19f20c9dceee862a909d279ef28f0abf091
SSDEEP 384:W+9xD0sO20SeBcV5fxZ2/AGbzx4fbIot3qnd9ZOxaefMlN+DW6hnx3YvPT1/sb:W+Lv0SpxeAidabHtydtZlNoq6
TLSH
T174531F0A28C395C6E40188B28E9773E40ABF6D1F3C52DE6FEF07192515F9224A07697F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads