Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/08/2026, 14:08
General
- Target 618f9a31c7cb9733d0c425d82a8c8a91102b81077e74400b45402fc09424e522.exe
- Size 1.7MB
- Sample260816-rfva3sdg74
- SHA256 618f9a31c7cb9733d0c425d82a8c8a91102b81077e74400b45402fc09424e522
Malware Config
Signatures
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 32 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\618f9a31c7cb9733d0c425d82a8c8a91102b81077e74400b45402fc09424e522.exe"C:\Users\Admin\AppData\Local\Temp\618f9a31c7cb9733d0c425d82a8c8a91102b81077e74400b45402fc09424e522.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 5962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1140 -ip 11401⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1140-0-0x0000000000400000-0x00000000007D1000-memory.dmp
memory/1140-1-0x0000000002630000-0x0000000002690000-memory.dmp
memory/1140-9-0x0000000003710000-0x0000000003711000-memory.dmp
memory/1140-8-0x0000000002620000-0x0000000002621000-memory.dmp
memory/1140-7-0x00000000025E0000-0x00000000025E1000-memory.dmp
memory/1140-6-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/1140-5-0x0000000002580000-0x0000000002581000-memory.dmp
memory/1140-4-0x0000000002610000-0x0000000002611000-memory.dmp
memory/1140-3-0x0000000002590000-0x0000000002591000-memory.dmp
memory/1140-2-0x00000000025B0000-0x00000000025B1000-memory.dmp
memory/1140-10-0x0000000003710000-0x0000000003711000-memory.dmp
memory/1140-13-0x0000000003710000-0x0000000003711000-memory.dmp
memory/1140-11-0x0000000002600000-0x0000000002601000-memory.dmp
memory/1140-12-0x0000000003710000-0x0000000003711000-memory.dmp
memory/1140-14-0x0000000003710000-0x0000000003711000-memory.dmp
memory/1140-16-0x0000000003710000-0x0000000003711000-memory.dmp
memory/1140-15-0x0000000003710000-0x0000000003711000-memory.dmp
memory/1140-17-0x0000000003700000-0x0000000003701000-memory.dmp
memory/1140-33-0x0000000000400000-0x00000000007D1000-memory.dmp
memory/1140-34-0x0000000003700000-0x0000000003701000-memory.dmp
memory/1140-29-0x0000000003710000-0x0000000003711000-memory.dmp
memory/1140-28-0x0000000003710000-0x0000000003711000-memory.dmp
memory/1140-27-0x0000000003710000-0x0000000003711000-memory.dmp
memory/1140-25-0x0000000002870000-0x0000000002871000-memory.dmp
memory/1140-24-0x0000000002880000-0x0000000002881000-memory.dmp
memory/1140-23-0x0000000002890000-0x0000000002891000-memory.dmp
memory/1140-21-0x00000000027C0000-0x00000000027C1000-memory.dmp
memory/1140-20-0x0000000002800000-0x0000000002801000-memory.dmp
memory/1140-19-0x0000000002830000-0x0000000002831000-memory.dmp
memory/1140-32-0x0000000003700000-0x0000000003701000-memory.dmp
memory/1140-38-0x0000000003700000-0x0000000003701000-memory.dmp
memory/1140-37-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/1140-36-0x00000000028D0000-0x00000000028D1000-memory.dmp
memory/1140-35-0x00000000027E0000-0x00000000027E1000-memory.dmp
memory/1140-31-0x0000000003700000-0x0000000003701000-memory.dmp
memory/1140-30-0x0000000003710000-0x0000000003711000-memory.dmp
memory/1140-39-0x0000000003700000-0x0000000003706000-memory.dmp
memory/1140-26-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/1140-22-0x0000000002840000-0x0000000002841000-memory.dmp
memory/1140-18-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/1140-40-0x0000000002630000-0x0000000002690000-memory.dmp
memory/1140-41-0x0000000003710000-0x0000000003711000-memory.dmp
memory/1140-42-0x0000000002560000-0x0000000002561000-memory.dmp
memory/1140-43-0x0000000002570000-0x0000000002571000-memory.dmp
memory/1140-44-0x0000000003700000-0x0000000003701000-memory.dmp
memory/1140-45-0x0000000000400000-0x00000000007D1000-memory.dmp