7eadb463bdf3cd1de633b0a292b485fcca7647ca5f9145600f784c7dd5ddf115

Analysis

user interaction
yes
max time kernel
8s
max time network
9s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vcredist_x86_vc141.exe
Size 14.0MB
Sample260819-w9769a1aqa
SHA256 7eadb463bdf3cd1de633b0a292b485fcca7647ca5f9145600f784c7dd5ddf115
MD5 e8e0bb4f12ec984cce63665b4a4f3f09
SHA1 cbfcd67c7660e186a12e4523ffc9300a45bd728b
SHA512 f895e1146acd8a4f01f13a9e94ccf5fb4c0726ce6554fe1ae93ea1fa07a484a074e6fa0aeccf1a22733ea164d49cf993f6e5983a991072dc5968e9561e7de2dd
SSDEEP 393216:+jFzlptVYmfr7yBG/4doNifUXxE2MCg5OxMmnH:+DpttD7yBG/WoXXxE2M1iz
TLSH
T154E63333A5844036DFF70477A968A9203F3CD62423158ABAE2CCDD5D27B919223FB756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4216	vcredist_x86_vc141.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86_vc141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86_vc141.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 204 wrote to memory of 4216	204	vcredist_x86_vc141.exe	89

C:\Users\Admin\AppData\Local\Temp\vcredist_x86_vc141.exe
"C:\Users\Admin\AppData\Local\Temp\vcredist_x86_vc141.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:204
- C:\Users\Admin\AppData\Local\Temp\vcredist_x86_vc141.exe
  "C:\Users\Admin\AppData\Local\Temp\vcredist_x86_vc141.exe" -burn.unelevated BurnPipe.{1A7C7210-086F-4430-A9F7-87EAC277782C} {C43EDC45-9155-4C91-A6B7-A114D84F802A} 204
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

license.rtf

Path C:\Users\Admin\AppData\Local\Temp\{67f67547-9693-4937-aa13-56e296bd40f6}\.ba1\1055\license.rtf
Size 177KB
SHA256 f79108a254f876e0f6bbcb05a9effbe25dc252e7ea256bfe3fd28ceb79737f25
MD5 f1a281f74d3e91d16dd26d1f313cd8a9
SHA1 ddb2ca9032c5a9c091eac53b679f6ba428077b00
SHA512 484c5ca26275427e1fb74d3217a22a0e4aac409aba973e78d7ad68834e7ad1d86c7855d34b227925200f941d288dfc09477b2d7dfe0856810c6c847297b8d625
SSDEEP 3072:3/Qfs1vJ0gJ68SfSRJj7Jnk/O1BEBrV3H/zI9uu4GyKcpwQ53p/L5cAN/3qvS70z:Y/N59E
TLSH
T167041DB840419694D26282779E68F5489B32F00964FCF4DCD39DE3B9F07EEA46BE8447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{67f67547-9693-4937-aa13-56e296bd40f6}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{67f67547-9693-4937-aa13-56e296bd40f6}\.ba1\wixstdba.dll
Size 171KB
SHA256 856c96f31c63bd3a00ff7feefc3a5ccb5af7b2fa229e687519a9c5d13cd6d4cc
MD5 f7f61854e65bc49951283c9a1e52c945
SHA1 775948f5a0326f31877883a1030543c86ffb47b8
SHA512 6a54b2568341223db2a5747ebd8cc8a6b1cfe7601b6d894e1f641c2daceaf56784d42c00d7a8857b1d442b7744155c7848d5a63fdd0403aa4a0260603b7ad356
SSDEEP 3072:v7zY+j0Xb3bQKeEQ+JPvwaU9eD7NGKOjp6v2Lxyecd+6xZnYqLcwv:v7/j0rkfEQ+JwkD7NGKspbWYocwv
TLSH
T19C048E1175D09079E7FB1B3C5D3861255EBFB9201F60C98E67989D6A1EB01C0AB35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads