Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 04:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7eb462c5496b7ea30c14eefda4406be25b1aef5a67134f47e958eb61b61538a2.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
General
- Target 7eb462c5496b7ea30c14eefda4406be25b1aef5a67134f47e958eb61b61538a2.exe
- Size 1.3MB
- Sample260824-epfg3axzhy
- SHA256 7eb462c5496b7ea30c14eefda4406be25b1aef5a67134f47e958eb61b61538a2
- MD5 44c7c6b137091691d1301e7fd149704a
- SHA1 48cb1339a3181e08c59a017828b444f838f0c64d
- SHA512 5d4673a9cc9a26df6027b5cb00d9da25e779db479121d5e424521001055e1cf5fc7c893c122120d514dd618e3fe6f1884e35adf42a053d68171c17cfbea84eb5
- SSDEEP 24576:wA+GgBOjRBbvRrjrVvN71dNPja2mpANa+GkkjfbEQD4G3rRQ:wIBhrVFxjraZpA8kkzdsMR
- TLSH T10B55BF06BA8380F2D6053A3104EB6B36DA35DA452B25CFD79368DE7D6C33181EA3725D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1080-0-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-40-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-46-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-42-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-38-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-36-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-26-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-11-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-9-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-7-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-4-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-44-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-31-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1080-2-0x0000000010000000-0x000000001003E000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7eb462c5496b7ea30c14eefda4406be25b1aef5a67134f47e958eb61b61538a2.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1080 7eb462c5496b7ea30c14eefda4406be25b1aef5a67134f47e958eb61b61538a2.exe 1080 7eb462c5496b7ea30c14eefda4406be25b1aef5a67134f47e958eb61b61538a2.exe 1080 7eb462c5496b7ea30c14eefda4406be25b1aef5a67134f47e958eb61b61538a2.exe 1080 7eb462c5496b7ea30c14eefda4406be25b1aef5a67134f47e958eb61b61538a2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7eb462c5496b7ea30c14eefda4406be25b1aef5a67134f47e958eb61b61538a2.exe"C:\Users\Admin\AppData\Local\Temp\7eb462c5496b7ea30c14eefda4406be25b1aef5a67134f47e958eb61b61538a2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1080