fe9a057872ef2728255d190beb20be35056bb096435e2377da2538a2cc591003

Resubmissions

17/08/2026, 04:51

260817-fg6jysem4x

17/08/2026, 04:48

260817-fe4mksem3s7

Analysis

user interaction
yes
max time kernel
187s
max time network
189s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/08/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xDecoder-14.0.zip
Size 4.8MB
Sample260817-fe4mksem3s
SHA256 fe9a057872ef2728255d190beb20be35056bb096435e2377da2538a2cc591003
MD5 835a85b9eec9db7502fa7d1f9699a579
SHA1 ed0b7958601795198a24ca2db53a659c37e4c47f
SHA512 6093c4a5b3e5312cb6f40dd42d6167fd48524008f66d415e6b0e4011d91e7ab92e05d1e89678a8210521b07d18451c01064050c8f64eb731c941b1d40983815e
SSDEEP 98304:oVN89o8XJYEAp3wAFnm8AzewkRZEHtWIj0HSvPJVeo0H9q+IodFgCZWI9W:EN89o85Za3c89VYtm6c9q+IojbZWI9W
TLSH
T1F13633C0F55309808D6A4B91175C2CAE9A82D34B4CE6AA19C1FF374D5A0EF69D9CE0BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4524	xDecoder.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xDecoder.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1792	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3600	7zG.exe
Token: 35	3600	7zG.exe
Token: SeSecurityPrivilege	3600	7zG.exe
Token: SeSecurityPrivilege	3600	7zG.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3600	7zG.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\xDecoder-14.0.zip
1⤵
PID:644

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4268

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\xDecoder-14.0\" -spe -an -ai#7zMap21245:84:7zEvent16626
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3600

C:\Users\Admin\Desktop\xDecoder-14.0\xDecoder.exe
"C:\Users\Admin\Desktop\xDecoder-14.0\xDecoder.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4524

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\aaa.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xDecoder.exe

Path C:\Users\Admin\Desktop\xDecoder-14.0\xDecoder.exe
Size 7.4MB
SHA256 3462a49587e6b26caed241ecca031ad18faec919e97598c6dba903bedcc78bd4
MD5 ba47700d60b5f129ef9b97bcd45b7343
SHA1 29969e523556e6a336ae891f6e597c1205ab6fc9
SHA512 fd6ad5503d89bd8ca1edab721095faba23dd2a7119f39b40d16e688fc644bd52f668c9ed1c8b35818694b7a2251ccf4f4e0d1741ea35e2a178e522625e912a54
SSDEEP 98304:YWzPCUi76MsKvY5R5mT/tR0PfzToWwK3tkVVnS/Tf:FzPpWv1puHzToWwK3tFf
TLSH
T10F76BFE37780181FFB807834D8D456269725D86912BA86E7B5753F29CAFB2C13B38B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download