596240f069c04e21d18c6851b51a2fbd092e09c67e0a4355306375a6662b1cf7

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
596240f069c04e21d18c6851b51a2fbd092e09c67e0a4355306375a6662b1cf7.exe
Size 519KB
Sample260813-acd19axcne
SHA256 596240f069c04e21d18c6851b51a2fbd092e09c67e0a4355306375a6662b1cf7
MD5 ba893797a896a3711a0d594222c3bbb1
SHA1 5e4e93e8e4e86c4f48f13fd1c1f26df5e8f0d813
SHA512 62ebef48a595ca7e7e00842d507053bd01ab1b2deb40f289a84d8e1c277e40c5276009eac7607ed7d628d7c80abd84be5185706ea993cd00b64fff8bfd68d933
SSDEEP 12288:00hVOQL6sPByIyJmzEL1GL2nb6Okx2LIa:9bOQLhyIyJmzEJGq+Okx2LF
TLSH
T122B47D2AF6A0C036C4B79574C4A286A6FFB1B43127204ACFA790475A1F637D2BE3571D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4344-0-0x00000000005F0000-0x000000000067A000-memory.dmp	upx
behavioral2/memory/4344-1-0x00000000005F0000-0x000000000067A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	4344	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	596240f069c04e21d18c6851b51a2fbd092e09c67e0a4355306375a6662b1cf7.exe

C:\Users\Admin\AppData\Local\Temp\596240f069c04e21d18c6851b51a2fbd092e09c67e0a4355306375a6662b1cf7.exe
"C:\Users\Admin\AppData\Local\Temp\596240f069c04e21d18c6851b51a2fbd092e09c67e0a4355306375a6662b1cf7.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 472
  2⤵
  - Program crash
  PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4344 -ip 4344
1⤵
PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4344-0-0x00000000005F0000-0x000000000067A000-memory.dmp

Download

memory/4344-1-0x00000000005F0000-0x000000000067A000-memory.dmp