3749b1d8b7b20edba0adfa55a3ee7760fa5f560f4aa8352c59b940f1bcee21b3

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 08:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3749b1d8b7b20edba0adfa55a3ee7760fa5f560f4aa8352c59b940f1bcee21b3.exe
Size 75KB
Sample260820-j6h2qssfpc
SHA256 3749b1d8b7b20edba0adfa55a3ee7760fa5f560f4aa8352c59b940f1bcee21b3
MD5 9b7741f0aada4184562b1c4849d3fe7b
SHA1 ea1b6540bf9eadca55b3a845c75d7de34b9799c5
SHA512 01d27e576e3c38fbaad1721576de650075532e41159b98bec9bcce459522042c8cd0cfc263ccb37287eec707bdf367a9cfffd686b74f8a7481f06cf74b8232c9
SSDEEP 1536:WjAkZVnTDN20R+/rTs0NSOFulpVq00le/:YAkZlXN20R+jTs0NSOFu/w00k
TLSH
T130737D066F5F1102F41B4E70C6A2D1A6CEB9BCE23AAA11DFD720C5453EA17E04536B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4692	3749b1d8b7b20edba0adfa55a3ee7760fa5f560f4aa8352c59b940f1bcee21b3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3749b1d8b7b20edba0adfa55a3ee7760fa5f560f4aa8352c59b940f1bcee21b3.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 4692	1312	3749b1d8b7b20edba0adfa55a3ee7760fa5f560f4aa8352c59b940f1bcee21b3.exe	89

C:\Users\Admin\AppData\Local\Temp\3749b1d8b7b20edba0adfa55a3ee7760fa5f560f4aa8352c59b940f1bcee21b3.exe
"C:\Users\Admin\AppData\Local\Temp\3749b1d8b7b20edba0adfa55a3ee7760fa5f560f4aa8352c59b940f1bcee21b3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\3749b1d8b7b20edba0adfa55a3ee7760fa5f560f4aa8352c59b940f1bcee21b3.exe
  "C:\Users\Admin\AppData\Local\Temp\3749b1d8b7b20edba0adfa55a3ee7760fa5f560f4aa8352c59b940f1bcee21b3.exe"
  2⤵
  - Executes dropped EXE
  PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e591081.tmp

Path C:\Users\Admin\AppData\Local\Temp\0e591081.tmp
Size 5.2MB
SHA256 5350677fef302fb297e1bbf7d648f618dc08bbdd98035538cda5f9e15bc6da40
MD5 d92432ab6948ed05057b63817b96d481
SHA1 2d8369fb0b0c96fffca56fe3703734c02c8cddae
SHA512 4b6ae8e147f7f7a478a2ad02e385a84777d7bc1beb5d4846b3d00c01c65f50428707a1d891296928bf61b952f8b21ce27a28cf98bdcfef61bc8de740aad70e7c
SSDEEP 49152:kQ3sQmSoFCuQrb/TWvO90d7HjmAFd4A64nsfJzDtlod5Pqe8tOCED4PgasvccmnI:RwFCu6jHICG+D4y9kULnTH
TLSH
T1B1468C03BC9560E4CAEED230897A4252B7717C891B3177C32B64B6B92E737D85E39394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3749b1d8b7b20edba0adfa55a3ee7760fa5f560f4aa8352c59b940f1bcee21b3.exe

Path C:\Users\Admin\AppData\Local\Temp\3749b1d8b7b20edba0adfa55a3ee7760fa5f560f4aa8352c59b940f1bcee21b3.exe
Size 43KB
SHA256 a20c35eafc4f2085eb51ec9a778034cd1a3a64544611f1696cb3ac41106eddd1
MD5 66b42283b8cf9ff5b88b9f1c068869a0
SHA1 ac00d2c6fb87d3317bfe3c173a2486e1d036109f
SHA512 c153b34a46136defd807832b0ae8615c6716a7e7ac11a55e1bce221fd84b1ebbcf68d07667d611b5de7d3efc811e3f3c90a2ad8947e008ff396b659a55e15964
SSDEEP 768:G20zV+/r/TaOsOZu176PNLMfd7OFuo8pGonVIbp23+zjle/:G20R+/rTs0NSOFulpVq00le/
TLSH
T121136C435F5D1496F55B8AB4C5E2D227DDB4BDE07BA611CF0030D2852FA27E0263AB2E
MD5 SHA1 SHA512 SSDEEP TLSH