e4caa038bcfb52d1cd362b5f19b643bdad2b279e1fc59434fe32e5085d4d4b20

Analysis

max time kernel
152s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 09:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e4caa038bcfb52d1cd362b5f19b643bdad2b279e1fc59434fe32e5085d4d4b20.exe
Size 200.0MB
Sample260814-k5pcssgp2v
SHA256 e4caa038bcfb52d1cd362b5f19b643bdad2b279e1fc59434fe32e5085d4d4b20
MD5 c97269fb2ac816adab73fa52754ed755
SHA1 3d926bf5358e3545738c915caee0b5fe636bce54
SHA512 070c008128086e368c8bdf157613324df0aa0073d4048cf1e1f1da539cf50f624afa97852e986fd4f48aac1751fe1a92d5bca3bf36907338c8bca5926a68fd30
SSDEEP 384:WdvGyGNN4Ys3j6jyVak5rSNMQ4wqDr90vwtokwpwq6uHo6+qTQmuO6wA+oXYA/IL:WdvGHNZZk5mQNf2amuFP/IX6X/bamup
TLSH
T150A8822FF7C4B12BD2294AFE0991C0A30462FE17FDD1E607789D37299965A5CCE1222D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3292	2316	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4caa038bcfb52d1cd362b5f19b643bdad2b279e1fc59434fe32e5085d4d4b20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	e4caa038bcfb52d1cd362b5f19b643bdad2b279e1fc59434fe32e5085d4d4b20.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 4080	2316	e4caa038bcfb52d1cd362b5f19b643bdad2b279e1fc59434fe32e5085d4d4b20.exe	89
PID 4080 wrote to memory of 4336	4080	csc.exe	91

C:\Users\Admin\AppData\Local\Temp\e4caa038bcfb52d1cd362b5f19b643bdad2b279e1fc59434fe32e5085d4d4b20.exe
"C:\Users\Admin\AppData\Local\Temp\e4caa038bcfb52d1cd362b5f19b643bdad2b279e1fc59434fe32e5085d4d4b20.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c0vb4ujd\c0vb4ujd.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES65F4.tmp" "c:\Users\Admin\AppData\Local\Temp\c0vb4ujd\CSCF5753A401D847AFAA9A42A03FE074F6.TMP"
    3⤵
    PID:4336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 1560
  2⤵
  - Program crash
  PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2316 -ip 2316
1⤵
PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES65F4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES65F4.tmp
Size 1KB
SHA256 1226ae6c902e3bc17c1bd1df9ccb448d4002f37dad921bbb58c26811c67c33b2
MD5 c845b6eccb942533937085541069e698
SHA1 424bc8d9a5b81afdc9955a5c18c958014c6f843c
SHA512 7f415c24318881df924a165e1e6ea2ff73738cd8c69b9380cd80bb6d257faaece9fc889112e3bf113a8e294b64e620b3dda12bd8dff9acb6f27b742204106609
TLSH
T1DE21EF0993E8470FF0734731ACF6172F9234FC64EFA1579B894002282C41544EEA1B73
MD5 SHA1 SHA512 TLSH

Submit Download

c0vb4ujd.dll

Path C:\Users\Admin\AppData\Local\Temp\c0vb4ujd\c0vb4ujd.dll
Size 4KB
SHA256 ad153850d4cd4c1ce58b4692a170bb6636c69ac31dbd11341261c0b36bb34257
MD5 8ab16692c1cb8ac102c40b5c721fd298
SHA1 38411d22f7f36ed80f6a15d5f6208de767459565
SHA512 bd3906357db4c20ddc8087285037b02fd33fa2fc187a34d4a3a62168510f2d9ec28af1fb8ce20dbdf968c609f5db1737bc36097b99f797ae84335019a22533b2
TLSH
T11B81210367E94B1BF0BB873599F347526278FD609763CB1E4CC40269AC622201D61F75
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF5753A401D847AFAA9A42A03FE074F6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\c0vb4ujd\CSCF5753A401D847AFAA9A42A03FE074F6.TMP
Size 652B
SHA256 7b0495d49ae5ca1ed3ca36d6d1d21eb58ae8eb4e4b3eb9fe5af8796d8a9a0429
MD5 4c1ed8c1000f2149d119bb043b65c997
SHA1 8c211dd4865cc69573ef85eab23e2644d89d2b3b
SHA512 83ff4cdf6885d2fc2c0ee9d9cda88aeeac1446d9b7e698fa50167c32beee820f1798df8c9378de57d5af8261695f084211ce72e886ca1de247059839559e8ad3
TLSH
T1D0F05E09A3F8520EF5F34B30BDF643A795A9BC65DE3293ED184413196C64A109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

c0vb4ujd.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\c0vb4ujd\c0vb4ujd.0.cs
Size 677B
SHA256 9e298014201c7f542c821e732c296c3bba7d03bea47d0a1ce842562c2b5ba5d8
MD5 be3cad8959141d8fef0a1defaa93aaf0
SHA1 cdf411a47919caa8b8426faa468a51e6e75400cc
SHA512 8ede46f375fe1d069e79215e4e83de5b5f2313743eb8311e7eab4fa6df2e655f050761aed25998535040aa80920161db5d29fceb5ac389befe935f02cdcab94c
TLSH
T13E01DD002232CB793753510BBE57D0487135591326CAF81078EE0D45EF6A2A0256CB3A
MD5 SHA1 SHA512 TLSH

Submit Download

c0vb4ujd.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\c0vb4ujd\c0vb4ujd.cmdline
Size 183B
SHA256 f4e32e986a346197d43a33916b9fa792811944a928937688e08c05515e1e0158
MD5 8e3d7ca28d6cd323c5c25108f5acd704
SHA1 1632c2177cc0e0616a077786713c6ef655691a94
SHA512 8fd4333ff498a0daa6e2947c7dbe75c599c28a43b80d56eb724cbf91613a1ac025b31a0d5f81d858d15c655ceafd60bccd2e5c91e6922c762a15bcfcf8121542
TLSH
T1D7C0120A46C6C32D1588B12B1DA1B09C82F34F0B2FCD3F1C9B50844E2193008F6DB342
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2316-0-0x0000000074B72000-0x0000000074B73000-memory.dmp

Download

memory/2316-1-0x00000000005A0000-0x00000000015A0000-memory.dmp

Download

memory/2316-5-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

memory/2316-15-0x000000000F0A0000-0x000000000F0A8000-memory.dmp

Download

memory/2316-16-0x0000000074B72000-0x0000000074B73000-memory.dmp

Download

memory/2316-17-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

memory/2316-18-0x0000000074B60000-0x000000007531C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads