3d1734ebf94cc31c37cd9b2629b0761bc09f0704b96036c52fd1d147bc7f2b04

Analysis

max time kernel
300s
max time network
226s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CB-Keygen.exe
Size 3.6MB
Sample260819-weypbseq6x
SHA256 3d1734ebf94cc31c37cd9b2629b0761bc09f0704b96036c52fd1d147bc7f2b04
MD5 238f840a3861c65c112e534738c31cb4
SHA1 86b4d28579475a184e4f153a09b0443990b90c48
SHA512 d5fba65d5f23369a2869b49ae725ea3badc7ffc3b667167ea9333ee59bd5b440cedd0f869703c35174bac129432ce867bbcb01fdec896adecb12253d5711447b
SSDEEP 98304:ppUl2sRt7kumew42ntouGBgYf6CdN1lakvCsaAap98ydW:ppVsRhmeetouGXjl53a598OW
TLSH
T1C806334277C28473D4212C3282A49952A73C68602F62C7E7A3D27E7D97716D2E672F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4988	CB_KG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CB-Keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CB_KG.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 4988	2932	CB-Keygen.exe	90

C:\Users\Admin\AppData\Local\Temp\CB-Keygen.exe
"C:\Users\Admin\AppData\Local\Temp\CB-Keygen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\CB_KG.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\CB_KG.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CB_KG.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CB_KG.exe
Size 3.0MB
SHA256 3d00ef713f596b485e46f4cf103a4ca029df9940dbc89a831440a8063f1a66a8
MD5 5a9f0e83e1a6524ab7f6eacc314a5cba
SHA1 fbafbd248b31a3101c97fa1ea9897ef287febb50
SHA512 a2c14e66e65ddfcf4d67d5c6efccec44765216f8bcc78b7adb3461d8c3308a003400dfdd30a44f1e265f86ed7de12e13066b156a1275a111bd9a16459387fa1d
SSDEEP 49152:3k/V4RiIyxZknJdCMwbAgi4a3j7rTPW3xS7zIyCXyzF1mk5nA+fhB:mV4Ri/eCMDb4a3LTqxS7zIjy58k
TLSH
T1DCE51A2177128127D9630AB1DA4D86E94664EE242F30E5C731C87EAD6F73BD63E39321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4988-30-0x00000000005BB000-0x00000000005BC000-memory.dmp

Download