236e240dc175ca34eb6d93f6c1d44deaaec116e9556944fd92a97783fb2ad92d

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
236e240dc175ca34eb6d93f6c1d44deaaec116e9556944fd92a97783fb2ad92d.exe
Size 8.9MB
Sample260823-rertkagr8s
SHA256 236e240dc175ca34eb6d93f6c1d44deaaec116e9556944fd92a97783fb2ad92d
MD5 925e0b607d09b511d38202e3517b5995
SHA1 81198d9331926f4294c7a6aa9727c1f84321f553
SHA512 ba80b5b0ee24eef5557d820af629ff9e826c6978213c7c6ee6f3cedbb3837ef529e3ee9bb6eb3c0d11e381acf5fc5699a1ebeef2eaa430e21e4f52e4faa1bc80
SSDEEP 196608:p6RNO3+O5CmxJJ9ClUElapmhfnkWy7vQX5S:pRrCAJgCPpUn64pS
TLSH
T15196BF03F182C0F2C6092A3015BA6B399E789B561A35CFD7E3A4ED79AD72191D73710E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1268	empty.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\empty.exe	236e240dc175ca34eb6d93f6c1d44deaaec116e9556944fd92a97783fb2ad92d.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	236e240dc175ca34eb6d93f6c1d44deaaec116e9556944fd92a97783fb2ad92d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	empty.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: 33	1340	236e240dc175ca34eb6d93f6c1d44deaaec116e9556944fd92a97783fb2ad92d.exe
Token: SeIncBasePriorityPrivilege	1340	236e240dc175ca34eb6d93f6c1d44deaaec116e9556944fd92a97783fb2ad92d.exe
Token: SeDebugPrivilege	1268	empty.exe
Token: 33	1268	empty.exe
Token: SeIncBasePriorityPrivilege	1268	empty.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1340	236e240dc175ca34eb6d93f6c1d44deaaec116e9556944fd92a97783fb2ad92d.exe
1340	236e240dc175ca34eb6d93f6c1d44deaaec116e9556944fd92a97783fb2ad92d.exe
1340	236e240dc175ca34eb6d93f6c1d44deaaec116e9556944fd92a97783fb2ad92d.exe
1340	236e240dc175ca34eb6d93f6c1d44deaaec116e9556944fd92a97783fb2ad92d.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1268	1340	236e240dc175ca34eb6d93f6c1d44deaaec116e9556944fd92a97783fb2ad92d.exe	91

C:\Users\Admin\AppData\Local\Temp\236e240dc175ca34eb6d93f6c1d44deaaec116e9556944fd92a97783fb2ad92d.exe
"C:\Users\Admin\AppData\Local\Temp\236e240dc175ca34eb6d93f6c1d44deaaec116e9556944fd92a97783fb2ad92d.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\empty.exe
  C:\Windows\empty.exe 1340
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

empty.exe

Path C:\Windows\empty.exe
Size 9KB
SHA256 20e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
MD5 523d5c39f9d8d2375c3df68251fa2249
SHA1 d4ed365c44bec9246fc1a65a32a7791792647a10
SHA512 526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4
SSDEEP 192:8g+i1VkHYXYxKTUtmPeQpLMFnlI1cTtYiAxHbDq/MR9tpL2OMoUwGCfpAGdDeqVs:LLXYxKTUtmPeQpLMFnCQHAx7D0MnKOMJ
TLSH
T135120991A37D456ED9BE03B01AB15F0F9B36B801483157BE0AA0C1A93FF4512BB77782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download