bcfe9347e77098b49d903dbb032042d0bf3ab451ae1ae9c27aaacc4fff8a4912

Analysis

max time kernel
13s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
whatsappimagePI-220008115.exe
Size 858KB
Sample260822-dfswcsvtez
SHA256 bcfe9347e77098b49d903dbb032042d0bf3ab451ae1ae9c27aaacc4fff8a4912
MD5 499507052e868d156d7f441b3bb7fb05
SHA1 93062f33e8f7630afe8f87d66e78d8e94f0672c6
SHA512 5b04eea6cc1b0ab8fd2228210aa5a36164246d6667dc184a9b7f9ea765112f32eee2b875ff57b50b8dec66d0f824fa3a1f9154ef379fe4197016b41e94cc28f5
SSDEEP 24576:lbuyzTt5TI66rfMkKvq/izM8fIe3ap3Bhin:xuyzTXTI6QfM1vq/izMcRa1BUn
TLSH
T14B1512273F10C592F7FC0A30C16B561481B8EC25B99A1FAB2684775CED7A2D05E1FA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4656	whatsappimagePI-220008115.exe
4656	whatsappimagePI-220008115.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4656	whatsappimagePI-220008115.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\blepharoncosis.htm	whatsappimagePI-220008115.exe
File opened for modification	C:\Program Files (x86)\blepharoncosis.htm	whatsappimagePI-220008115.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whatsappimagePI-220008115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whatsappimagePI-220008115.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4656	whatsappimagePI-220008115.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4760	4656	whatsappimagePI-220008115.exe	89
PID 4656 wrote to memory of 4196	4656	whatsappimagePI-220008115.exe	90
PID 4656 wrote to memory of 4196	4656	whatsappimagePI-220008115.exe	90

C:\Users\Admin\AppData\Local\Temp\whatsappimagePI-220008115.exe
"C:\Users\Admin\AppData\Local\Temp\whatsappimagePI-220008115.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\whatsappimagePI-220008115.exe
  "C:\Users\Admin\AppData\Local\Temp\whatsappimagePI-220008115.exe"
  2⤵
  PID:4760
- C:\Users\Admin\AppData\Local\Temp\whatsappimagePI-220008115.exe
  "C:\Users\Admin\AppData\Local\Temp\whatsappimagePI-220008115.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nssADEB.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dyewoods.jpg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bippendes\svrddanse\Dyewoods.jpg
Size 914B
SHA256 0eb01d3890e13f2cb746c646679b82fdf33607216ce4938f1544c776c2eab748
MD5 b498c8501cb8359b7133446b08c599a5
SHA1 60870de7f1d851a44c79832a87b693bce2e4f61b
SHA512 a2153022b9df0a97ba9340ef774a81e99d6859e9fe18071b4c4260427799084dc262bd65574b0484f8c22a3886b7f070440fc96c31788762d685ee9bf4b97326
TLSH
T10D114A69B7C753408F2785B5545B357ED1CF49467D6077313D618AB8C950DF4C044A7C
MD5 SHA1 SHA512 TLSH

Submit Download

Harianas.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bippendes\svrddanse\Harianas.ini
Size 363B
SHA256 addd9c1fc90122e6a3be547f2499f7565a609fa914ab41710dcd7c37d6cd021e
MD5 4e0173122bde9103c7f2b87708a354a3
SHA1 19f69a7ed2a702f5818e131f33fe31b6e87d3321
SHA512 0322ae21bb464e0e3aff723fa1685df1bb73f62a756bfd51161851273d6ea141c6ae5d79f65d5821bfd313436c77818d1af5a66e9b6ee62b975890b6f595e3a9
TLSH
T1FCE06028850A8F2C8E838200B6A108B0C1AC338004AB3430B7DD0B43B0420EDC2FCE65
MD5 SHA1 SHA512 TLSH

Submit Download

redemptor.jpg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bippendes\svrddanse\Intermining234\Leningrads\redemptor.jpg
Size 45KB
SHA256 3254ab071851baa1dcabbf31185b2c3445a1ddfdef69254ec3268c37d0033724
MD5 1e481ecdedba14856fe8cd27e6aae2a5
SHA1 4e6b4a94baf315e147c456ada25767b5ef61e1c0
SHA512 88f2bdb866a684c78637b8b48f79f5366e67fbbe20a2dcb40977c8dde0d844fc0339dd7e27a64c7ecd30fe014a8d8388d112d3e6fa4957f27856e68f762782b7
SSDEEP 768:z4Pjgenv/oc3ncZnPSMXiWCWAyj3GkB4If33CV794iafxDzFY7I/g79C5S2KUQ4L:z4rhHoSnSDHGkB4EA4LHY7IyI5Sr4yIl
TLSH
T14523F12A773081025BA541D0800A7643A3AABBB0F64D893ADD4CBF17F168E3E477577A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

splids.det

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bippendes\svrddanse\Intermining234\Leningrads\splids.det
Size 4.6MB
SHA256 776fceb7822e543f6f0ed7ac504886b2bf1fbe4a74c1251b44f3415431e9c4fc
MD5 12814a9bd5d5882eaa4b256f4f340b44
SHA1 ce25ee57c79b35be62b711a996c46cdb79a1b65d
SHA512 61429cf9551708aa855c8f244358dfee391bc67d634565c582df4949f1e3a6a958442a7488cd47298ebb77b8b71de4ee4ab4125a712f221f923956309e3e3598
SSDEEP 3072:dVo7FSbAnqlsmxQJ1L0l8Q1RjgS9TaVxcqUJhpDnu7ZMg+/LBjdPt3VcnA7iY75S:n94
TLSH
T13D2612CCC325F082AE92D5BDB81168ADF345124E183835FB647B85969ECE3C3D92D194
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

begroan.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bippendes\svrddanse\Intermining234\begroan.txt
Size 471B
SHA256 ccad362c13be4e54f4b41bd653f2882a1ca8174006f9e1f353bd5d134ff79a0c
MD5 16260a4db26536d5fd3dce271e835e53
SHA1 486f5e82a9e43406e7b3bdcd09e0ec9a89323f94
SHA512 401432823b19b8c5fdeae5af32d3c191c7a0b348a3126515062df5983c8f50bb32b7c58f4b991ccf888af2c2a5668fdc5c604983bc65a725ad2de2a7a11f1668
TLSH
T150F0DC50E8850187198B1ECE98C61DB8DAE9CD11160D25F796D8088FE84AA0DA3B4347
MD5 SHA1 SHA512 TLSH

Submit Download

beundringen.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bippendes\svrddanse\Intermining234\beundringen.ini
Size 700B
SHA256 2aeaa592ce805b6e5ce15600b0b3058697fdd679dabbab27e98f1eed4455ddb2
MD5 6b184dbfea65f52a1c51e88e363f17cf
SHA1 2fb0e0f4740451e5d771f756879e9b9eaff493aa
SHA512 312ca8f7c53a55cfc19681c7f6570df81851876f904db4ea226d9a7c8c137397052ded144a30d3c32a96aae32a4d422949fb5469a7c9e5fe349b809a4928826a
TLSH
T1F601FE12C9A641256DCB2F66DCC0665AD474ED88522041D671DF038F291B6ADC3FAA1D
MD5 SHA1 SHA512 TLSH

Submit Download

dresserede.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bippendes\svrddanse\Intermining234\dresserede.ini
Size 603B
SHA256 6d87928c64166fc3f1097e5bda69525468b055ad77faa932f29279127db451d5
MD5 f84b7324e5b29c5e49fad298009694bd
SHA1 302defc3bba5eb2e07d8c158185f5a48732d2037
SHA512 9e25b63c4b52f17d4a9655e24c96a2a4a710dc8f346accbd766cb090ebc24aa5ceca8713055d9b4466f6c6bd50e680c30e70cf1ab46e52b123716eab049697f9
TLSH
T1E2F0410CDAB7072C39A727024F3478C317B85416C25B02A8EE06DB15A1812BC839E7AE
MD5 SHA1 SHA512 TLSH

Submit Download

furloughs.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bippendes\svrddanse\Intermining234\furloughs.txt
Size 641B
SHA256 eaded6c7d02a885b5c9994e0eaa2ead1247b97e41a08fe8ca58bc579adf846f2
MD5 70cb2c67014b4ffe377b8c9584b39007
SHA1 64bc5d55c1fa9ab250c4d104c5210b36e74228da
SHA512 4c5fe0d0c92592f32460b3e9430ba6d63e91f86141b256542f840f9f5e3c4fa0dd3af25267981c60f965123c78517f9aae7219c8ae8394a0960c64c0a19410d0
TLSH
T123F00857ED7922B41FABC34DE0E5CE5CA1A4D3920D480DFA5DBC230B3052458537663D
MD5 SHA1 SHA512 TLSH

Submit Download

hydrofoils.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bippendes\svrddanse\Intermining234\hydrofoils.ini
Size 189B
SHA256 8368de6f9ec7b2fa4e6511be8641c515fc16f84a2182dd608d3995811746ead0
MD5 1046b94a532fe3ae34823f915b9f7901
SHA1 3828912f10b26cee6d282a25e10b8130d1a2d8f5
SHA512 e73644cbc74d50071d448b1cc0840b4f84a206a832dd2653b3ffa7ada02236f83faf3c4fd13b41ee80b321ab4877c46f1f6c0ebf89be0708129162dc47b44a06
TLSH
T177C0C06E2F7714F88372378018039820D3888200C2104F19F3D0CB285467EC2210335C
MD5 SHA1 SHA512 TLSH

Submit Download

Kreplech.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bippendes\svrddanse\Kreplech.txt
Size 708B
SHA256 066a8fcd7148d2cc729addb42b54245f701b3e7247202986de23e167e38d65c4
MD5 4f28c9d27f44e88c471b16197929d8b6
SHA1 cf77105bf47c156dbd50e8508d3ba9328937afbc
SHA512 7c11a5902cc370482d4ee85e1eb8898380acac74e07d517a37c809433a8c5ffd91c4f6e258c02b015296754f96ada992cd84fd6fed89b95233a717d5470f2ad1
TLSH
T14B018370EE0003AD3A8E221CBCE17CA2A4874325C3A004F458E9631D6092EFDE1B15AF
MD5 SHA1 SHA512 TLSH

Submit Download

Magtsprogets226.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bippendes\svrddanse\Magtsprogets226.txt
Size 460B
SHA256 d38a666093114d08dac70177dd2dde8b23188fc7636f80b8df78da9b64339ee4
MD5 b64bdced3c5d5a6bd21bec30b1d042f9
SHA1 5a2ff4c803f47cc181af2a8a0084702ac21cbb85
SHA512 491ee2dac3ebd41cdc7d918488f5a6e9ca378477bac2bd9ce343e42f6a29ab760751b702ebbf9537d0fb103086a6f70adc64a668c273bd60530b3e8aff32871d
TLSH
T11FF05CA2B09B70B80E070246CEE24C18019D8B20BC9D3CB1F128DA2FF7030904B3292A
MD5 SHA1 SHA512 TLSH

Submit Download

Rumforskning245.jpg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bippendes\svrddanse\Rumforskning245.jpg
Size 24KB
SHA256 eeebbda4f4628bcf0035e1d4920214f5d7ae2b3cae3ac30f28bed780d28a637c
MD5 e682e363a02cfdc34ac74aa18069193b
SHA1 587383d21f7041b7d21f9a9a4517abb2cd5c53d4
SHA512 09b4fd2caf46a6e60ea9a3cb86a735b339884375f00060a17644adc431f86702aa38acf38e040dafaf85008c67f6d3be962658455e166f1830f4a376fa2a34f9
SSDEEP 384:rTE2AemXcOgx7MEm+4Pu+H8FCaPnTwwkwmyUb6Dip8wgUDh4GWuoUuIl4v2IZ:rTSecg7gJETwwkwmyUb62zfNoRZuo
TLSH
T1A6B2E17B940579018FE765EA45B37FDB70658C31BC9861FB8090AEB1851BCBC8D88E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tumbleres.jpg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bippendes\svrddanse\Tumbleres.jpg
Size 11KB
SHA256 9416e7ae353ff9e1c0b7c52a227a88a7a4bd4680b26670a435fb21234a093c5b
MD5 8bcdde21364df5af1bf56abcafe66d5f
SHA1 5af2711d2317afc3aea217dfd9260ed8cb9492b0
SHA512 30d8d9c4d628c45fe9364ebf053f07bd58e700af3baa582bb319969b10147febd444f2d5d890c2f2d532aefbffdf2a81997d41c66300281268479202b8b57331
SSDEEP 192:LyHx0c5MyEeGNrCCGGLnK+fDJDbyVXjpXgdwBdTvctvlbJychruzRh:maYEeG8CJnKsJDGXjpXgdKUtPyRFh
TLSH
T12142CF6E620829C517A79EEDB5663CA050C8E1E27C1D3730BCD09258E326DF47E2BBD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zincid.tal

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\bippendes\svrddanse\Valgmenigheders\zincid.tal
Size 2.6MB
SHA256 57fa4bc32993ad95bbde1969e22867dbacb623e07632cda86a639c80f8191a2b
MD5 4ceb533bac4e0c7a2ca2563a426e786d
SHA1 e3a4f22a6696e5509a92746264205a9e43a7a486
SHA512 0249b5c90b8ecb81e22cc2c31af9c83a2a2c69cc225b7c9b9980f7579ab50199d0955224ce42c10fe0e49e41a2177fcfa23e4a721c43bc3416cca64fc48ba3d8
SSDEEP 6144:SDtcsF+qgSAM3ZsKytdRI+42JpBRmJvljFyxeK16qhDJhUziPiYs/0X8SuebfWli:T
TLSH
T148C512DBA48A9DFB349ED9F865FF9B638CFC49131E0B2C658AF238C7000176CA885155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4656-23-0x0000000074365000-0x0000000074366000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads