Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/08/2026, 13:17
General
- Target 9d08b2f19f1f239652d9fc41500348262101a1fb88b2f9dc1dfe93d54b73d88d.exe
- Size 209KB
- Sample260817-qjcd1assct
- SHA256 9d08b2f19f1f239652d9fc41500348262101a1fb88b2f9dc1dfe93d54b73d88d
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d08b2f19f1f239652d9fc41500348262101a1fb88b2f9dc1dfe93d54b73d88d.exe"C:\Users\Admin\AppData\Local\Temp\9d08b2f19f1f239652d9fc41500348262101a1fb88b2f9dc1dfe93d54b73d88d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5ee4h1hm\5ee4h1hm.cmdline"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2DBD.tmp" "c:\Users\Admin\AppData\Local\Temp\5ee4h1hm\CSC3C83CBD71AF047AC88E3D4AC50F61F6E.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
5ee4h1hm.dll
RES2DBD.tmp
5ee4h1hm.0.cs
5ee4h1hm.cmdline
CSC3C83CBD71AF047AC88E3D4AC50F61F6E.TMP
memory/4948-6-0x00000000057D0000-0x0000000005836000-memory.dmp
memory/4948-19-0x00000000078A0000-0x00000000078BA000-memory.dmp
memory/4948-7-0x0000000074D50000-0x000000007550C000-memory.dmp
memory/4948-10-0x0000000005F00000-0x000000000625B000-memory.dmp
memory/4948-11-0x0000000006500000-0x000000000651E000-memory.dmp
memory/4948-12-0x0000000006530000-0x000000000657C000-memory.dmp
memory/4948-13-0x0000000006AA0000-0x0000000006AE8000-memory.dmp
memory/4948-14-0x0000000074D62000-0x0000000074D63000-memory.dmp
memory/4948-15-0x0000000074D50000-0x000000007550C000-memory.dmp
memory/4948-16-0x0000000074D50000-0x000000007550C000-memory.dmp
memory/4948-18-0x0000000007ED0000-0x000000000854C000-memory.dmp
memory/4948-0-0x0000000074D62000-0x0000000074D63000-memory.dmp
memory/4948-5-0x0000000005E90000-0x0000000005EF6000-memory.dmp
memory/4948-4-0x0000000005700000-0x0000000005722000-memory.dmp
memory/4948-2-0x0000000074D50000-0x000000007550C000-memory.dmp
memory/4948-3-0x0000000005840000-0x0000000005E8A000-memory.dmp
memory/4948-1-0x0000000005030000-0x0000000005066000-memory.dmp
memory/4948-32-0x0000000007900000-0x0000000007908000-memory.dmp
memory/4948-34-0x0000000007960000-0x0000000007982000-memory.dmp
memory/4948-33-0x00000000079B0000-0x0000000007A46000-memory.dmp
memory/4948-35-0x0000000008B10000-0x00000000090CA000-memory.dmp
memory/4948-38-0x0000000074D50000-0x000000007550C000-memory.dmp