8bf0698157be4f4ff169f261ed76261e5b8cc1d0a5262bf2fa9f2f0fe73d6b7d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8bf0698157be4f4ff169f261ed76261e5b8cc1d0a5262bf2fa9f2f0fe73d6b7d.exe
Size 8.6MB
Sample260821-rf8hpsfp21
SHA256 8bf0698157be4f4ff169f261ed76261e5b8cc1d0a5262bf2fa9f2f0fe73d6b7d
MD5 071c5cea717a34dc2e514e06e58cbbae
SHA1 9d9f9aba01f93e1b3b918418ec3819e17506d4e6
SHA512 1f37078ddfe50eb4003c1da93399f35b364bc8d03cc4e4743d338e7411b2d98685a9176fef2bd510d36717dca1859715b2dc901c360bc81c1234e8ae9ddeba94
SSDEEP 196608:+HhhrkHtv6fVXAyaTq2o8/hvY1ySp2W1LAjKCe/vORs:GhhQNvwhAQQ/hYESL1cjKf/vORs
TLSH
T177960163A242C0F1D2511831C077BFF9AAB54F8ACA11DAB7A795FDD53C32191E22724B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4196-0-0x0000000000400000-0x0000000000D03000-memory.dmp	vmprotect
behavioral2/memory/4196-1-0x0000000000400000-0x0000000000D03000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4876	4196	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8bf0698157be4f4ff169f261ed76261e5b8cc1d0a5262bf2fa9f2f0fe73d6b7d.exe

C:\Users\Admin\AppData\Local\Temp\8bf0698157be4f4ff169f261ed76261e5b8cc1d0a5262bf2fa9f2f0fe73d6b7d.exe
"C:\Users\Admin\AppData\Local\Temp\8bf0698157be4f4ff169f261ed76261e5b8cc1d0a5262bf2fa9f2f0fe73d6b7d.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 608
  2⤵
  - Program crash
  PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4196 -ip 4196
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4196-0-0x0000000000400000-0x0000000000D03000-memory.dmp

Download

memory/4196-1-0x0000000000400000-0x0000000000D03000-memory.dmp