1950a556d0c9ab780d6c80f172b7386f771a7a31421203964706ecb19dc111a0

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Счет на оплату С-11.exe
Size 276KB
Sample260812-ph4anace55
SHA256 1950a556d0c9ab780d6c80f172b7386f771a7a31421203964706ecb19dc111a0
MD5 0e74b78495d0db33552e6dda8f16e4c3
SHA1 421d940cf0995fd4759608b12a0a8cc5dd641b3f
SHA512 6b434601cfa405204244246ce2b2600ba67afea76420ce86e0bed86c55e3f2fded597e93a3883ec078680e902a840cb248789c09f03938a04219a4ed9de8185a
SSDEEP 6144:oqdjVTcstDcbLfwiXURDUX1gzDUY0TbmftZf9b2tfaECEJ3yu:oqVdcsmDEUXHDyDb2tfaEP9
TLSH
T19C54AFB8B6146DD6F67E537BDA96ACD903B52E32CA8B94CD806477C30573335EE02809
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6084	a3e3079a.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5208	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Счет на оплату С-11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a3e3079a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5208	cmd.exe
2152	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2152	PING.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 6084	2776	Счет на оплату С-11.exe	88
PID 2776 wrote to memory of 5208	2776	Счет на оплату С-11.exe	90
PID 5208 wrote to memory of 2152	5208	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\Счет на оплату С-11.exe
"C:\Users\Admin\AppData\Local\Temp\Счет на оплату С-11.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\a3e3079a.exe
  "C:\Users\Admin\AppData\Local\Temp\a3e3079a.exe" /u
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2 > nul & del /F /Q "C:\Users\Admin\AppData\Local\Temp\Счет на оплату С-11.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5208
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a3e3079a.exe

Path C:\Users\Admin\AppData\Local\Temp\a3e3079a.exe
Size 276KB
SHA256 1950a556d0c9ab780d6c80f172b7386f771a7a31421203964706ecb19dc111a0
MD5 0e74b78495d0db33552e6dda8f16e4c3
SHA1 421d940cf0995fd4759608b12a0a8cc5dd641b3f
SHA512 6b434601cfa405204244246ce2b2600ba67afea76420ce86e0bed86c55e3f2fded597e93a3883ec078680e902a840cb248789c09f03938a04219a4ed9de8185a
SSDEEP 6144:oqdjVTcstDcbLfwiXURDUX1gzDUY0TbmftZf9b2tfaECEJ3yu:oqVdcsmDEUXHDyDb2tfaEP9
TLSH
T19C54AFB8B6146DD6F67E537BDA96ACD903B52E32CA8B94CD806477C30573335EE02809
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download