3986e8d3d44926279a4bf95be7e41f70a5f1a891eaec5a00e8af2985a2de6e50

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3986e8d3d44926279a4bf95be7e41f70a5f1a891eaec5a00e8af2985a2de6e50.exe
Size 723KB
Sample260822-rdc9saverd
SHA256 3986e8d3d44926279a4bf95be7e41f70a5f1a891eaec5a00e8af2985a2de6e50
MD5 618d9e10577fe137c4c512c06c90dd29
SHA1 cdedf75d03c341a0a91879cd95e4ce2b4cf0a51f
SHA512 85f6f097471d35de5f62eb58d3222c5e0f86f3bce485ffb9eebffd294ff5b1aa59f300f5379939deabd46167532227c35f5658f56772630a4f82184291d03a62
SSDEEP 12288:KFmnyop6sWIDjFbFM++j2OpuKmInPzrzrOZf+oR76GFHz/0MCowfGAM0iejv48o0:KFmnyop6sWIDjFbFM++j2OpuKmInPzrJ
TLSH
T196F42A237211C493D0212BFA56E616283CB897192D799863DFD8AE637DF4632CF3A50D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\gzip.dll	3986e8d3d44926279a4bf95be7e41f70a5f1a891eaec5a00e8af2985a2de6e50.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3986e8d3d44926279a4bf95be7e41f70a5f1a891eaec5a00e8af2985a2de6e50.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6428	3986e8d3d44926279a4bf95be7e41f70a5f1a891eaec5a00e8af2985a2de6e50.exe
Token: SeDebugPrivilege	6428	3986e8d3d44926279a4bf95be7e41f70a5f1a891eaec5a00e8af2985a2de6e50.exe

C:\Users\Admin\AppData\Local\Temp\3986e8d3d44926279a4bf95be7e41f70a5f1a891eaec5a00e8af2985a2de6e50.exe
"C:\Users\Admin\AppData\Local\Temp\3986e8d3d44926279a4bf95be7e41f70a5f1a891eaec5a00e8af2985a2de6e50.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6428-0-0x0000000000400000-0x00000000004CE000-memory.dmp

Download