e97b0273b5930d0ea8759b2cf9512b329c03f7900608e2e352d7b28edfd69fce

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e97b0273b5930d0ea8759b2cf9512b329c03f7900608e2e352d7b28edfd69fce.exe
Size 11.6MB
Sample260817-nc2dfaztcy
SHA256 e97b0273b5930d0ea8759b2cf9512b329c03f7900608e2e352d7b28edfd69fce
MD5 a9e2b16e8ce771572ccc055eccf04378
SHA1 47f45a072705be6a00e6e7aa4cd1db0538262327
SHA512 3dd50512a0d04490a3aedc3397ae0c13d590d1bd5bb8d28a1499d21f9e6a6a2183c02ad0f73c57b44b9ead2968b0841f0f8ca65aa25a023282a8e4a574cd601e
SSDEEP 196608:lJTonPPKwKMhWN1Xvy3J5f+tPvgff6P3jqZh43YvzyPChoSy5eFfIV:4n6zqweV+1gfy/+ZnyPGoSy5mQ
TLSH
T1E3C6D0D17A19F1CFD08A29B8D897CF03D52C4BFA52149D42ECA9B5BE5D23C812187F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4728-0-0x0000000000400000-0x0000000000F99000-memory.dmp	themida

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e97b0273b5930d0ea8759b2cf9512b329c03f7900608e2e352d7b28edfd69fce.exe

C:\Users\Admin\AppData\Local\Temp\e97b0273b5930d0ea8759b2cf9512b329c03f7900608e2e352d7b28edfd69fce.exe
"C:\Users\Admin\AppData\Local\Temp\e97b0273b5930d0ea8759b2cf9512b329c03f7900608e2e352d7b28edfd69fce.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4728-0-0x0000000000400000-0x0000000000F99000-memory.dmp

Download

memory/4728-1-0x0000000000400000-0x0000000000F99000-memory.dmp