7dbbae47f639fb8f137fc887fd1be2298b9518dadc6dd97a9f1817afb758204e

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7dbbae47f639fb8f137fc887fd1be2298b9518dadc6dd97a9f1817afb758204e.exe
Size 75KB
Sample260814-ptb1jsbn3x
SHA256 7dbbae47f639fb8f137fc887fd1be2298b9518dadc6dd97a9f1817afb758204e
MD5 b26f44fbc17f991162973a856e5adf8a
SHA1 f8e218e75d2f862f9cced4def477b435a5c080e2
SHA512 13ff559332c56ecf4f37cd56ddc91e531094da493a7d7d8e5643d719e52595a466f51dae4c970f6d1722c1cbd005bcb528060ca40c440af0c62ffbaedd3183c2
SSDEEP 1536:WjAkZV0TDN20R+/rTs0NSOFulpVq00le/:YAkZqXN20R+jTs0NSOFu/w00k
TLSH
T1BA737D066F5F1102F41B4E70C6A2D1A6CEB9BCE23AAA11DFD720C5453EA17E04536B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3200	7dbbae47f639fb8f137fc887fd1be2298b9518dadc6dd97a9f1817afb758204e.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	7dbbae47f639fb8f137fc887fd1be2298b9518dadc6dd97a9f1817afb758204e.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCXDF7F.tmp	7dbbae47f639fb8f137fc887fd1be2298b9518dadc6dd97a9f1817afb758204e.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	7dbbae47f639fb8f137fc887fd1be2298b9518dadc6dd97a9f1817afb758204e.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXDF8F.tmp	7dbbae47f639fb8f137fc887fd1be2298b9518dadc6dd97a9f1817afb758204e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7dbbae47f639fb8f137fc887fd1be2298b9518dadc6dd97a9f1817afb758204e.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 3200	4716	7dbbae47f639fb8f137fc887fd1be2298b9518dadc6dd97a9f1817afb758204e.exe	89

C:\Users\Admin\AppData\Local\Temp\7dbbae47f639fb8f137fc887fd1be2298b9518dadc6dd97a9f1817afb758204e.exe
"C:\Users\Admin\AppData\Local\Temp\7dbbae47f639fb8f137fc887fd1be2298b9518dadc6dd97a9f1817afb758204e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Users\Admin\AppData\Local\Temp\7dbbae47f639fb8f137fc887fd1be2298b9518dadc6dd97a9f1817afb758204e.exe
  "C:\Users\Admin\AppData\Local\Temp\7dbbae47f639fb8f137fc887fd1be2298b9518dadc6dd97a9f1817afb758204e.exe"
  2⤵
  - Executes dropped EXE
  PID:3200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 554KB
SHA256 2c977b99119c4f1c3d216da2ae779af098654d515f71d2ec636d8d6bc731a422
MD5 6fb14c052c9d1eba36ae55e7263dc89d
SHA1 af8c1155ecf391bdfe737812480b69cce4ce1955
SHA512 e947b31b0c4241d5bc4a8ac1a9cc2fab847e27cb09e55eb9da75863587397f599798c9adf9e8068848e18d7aed1e9e7e88f0df92296f6427f359380812a46c81
SSDEEP 6144:YnQLO76tlVr1Il5HlrJHU7kfLeeHVlK8SQBJ9LBKJwgdAmKa5rL:YQS86nHrUA9HVlK8SQBJ9t4f15rL
TLSH
T145C49E41F7D847E9E06AC534CA428646EAB178960F61F6DF03A0427A2F37AE54F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7dbbae47f639fb8f137fc887fd1be2298b9518dadc6dd97a9f1817afb758204e.exe

Path C:\Users\Admin\AppData\Local\Temp\7dbbae47f639fb8f137fc887fd1be2298b9518dadc6dd97a9f1817afb758204e.exe
Size 43KB
SHA256 a20c35eafc4f2085eb51ec9a778034cd1a3a64544611f1696cb3ac41106eddd1
MD5 66b42283b8cf9ff5b88b9f1c068869a0
SHA1 ac00d2c6fb87d3317bfe3c173a2486e1d036109f
SHA512 c153b34a46136defd807832b0ae8615c6716a7e7ac11a55e1bce221fd84b1ebbcf68d07667d611b5de7d3efc811e3f3c90a2ad8947e008ff396b659a55e15964
SSDEEP 768:G20zV+/r/TaOsOZu176PNLMfd7OFuo8pGonVIbp23+zjle/:G20R+/rTs0NSOFulpVq00le/
TLSH
T121136C435F5D1496F55B8AB4C5E2D227DDB4BDE07BA611CF0030D2852FA27E0263AB2E
MD5 SHA1 SHA512 SSDEEP TLSH