Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/08/2026, 07:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe
- Size 449KB
- Sample260825-js2xpaycqa
- SHA256 f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa
- MD5 8a7e9b51a880f21f397eb1a5a0e8f905
- SHA1 e342a6679ca7a2c9b2aaacf9bf1631e3f4a854f2
- SHA512 1f9cfb30d72f5aa5011e5b64cbf9c0bb7d4635aa3b4159fa612dc168a2f32f397dd83de42bf2c61b667223dd81c9a59da38184718a4a90ddbf83893baf9d23db
- SSDEEP 6144:NKxXYNt45SvibADn0ofR7JxNwqdfNqWVqQfIcbXr1VJCIA6srTZbRO:NKxCL0QJTEWVqQfISxVJCIApO
- TLSH T156A43A027790D036D16235764E97DEB566AABD235E23534B7BD07F3FBE301918A2830A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2044 f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe - Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX485E.tmp f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3788.tmp f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX43F2.tmp f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX4451.tmp f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX451F.tmp f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX3739.tmp f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX396E.tmp f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX3A1C.tmp f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX484D.tmp f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX483C.tmp f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX394E.tmp f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX44DF.tmp f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX39DD.tmp f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX4422.tmp f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX43B2.tmp f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2044 f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe 2044 f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1852 wrote to memory of 2044 1852 f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe"C:\Users\Admin\AppData\Local\Temp\f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe"C:\Users\Admin\AppData\Local\Temp\f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2044
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 618KB
- SHA256 54259521b409dff8509740fcd827b21dd575d7ac4af06835556f027e6f18059f
- MD5 450f48b0e2c578f05c60f1db3899aa51
- SHA1 0e5eb8991a4ed722e0ca63868f192a189b70c1d8
- SHA512 40a3995ea5ac3caf33b43a2fc8d8649def19f4eed4a6e18400e068d48937f57f3b40a6eaf7f69e41365d8316d297122120b3001fb00e85d8bf445c074ee7ae8d
- SSDEEP 6144:NxQLO76tlVr1Il5HlrJHU7kfLeeHVlK8SQBJ9LBKJwgdAmKa5rL:N+S86nHrUA9HVlK8SQBJ9t4f15rL
- TLSH T145D46C41B3D847E9E06AC5348A528D46EA717C970B63A6DF02A05E7B3F376E14F3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
- Size 1.5MB
- SHA256 54fd963ade8382030bb4a76f4439f3ef80b9565a046d7e8b3cfa0fc58cdef4b8
- MD5 295f232a6bea553aa54cecf92ab75e92
- SHA1 7faecbc09bdad68121112107fd360fda630c3dc1
- SHA512 e9db3c3cf59880feaebcb1cefc52fec1529c9b3cf1d86479197dbcbeb8649c2122cc85b3196f5e39d70b427827a87527f810daa9eaf2dcdc9f1a43009d474be5
- SSDEEP 24576:myoteh6euUHmEhK7eTuNdfxINakEtv9kWG2L1oaedpEukUoygGmq/Sl:mfehjvHHKTdfxINPEt99G2Bo7EukU1a
- TLSH T198756A03A29900E8D059D1B4C7568D26E9A27C470B27A6EF0B90BE173E77FE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e58367c.tmp
- Size 1.4MB
- SHA256 d3b78e7ed236350a7647030fcb7dfcef8a154aa67363741b13f53268a23ae01c
- MD5 8a74abcf6ab1f04e308431cd87cf3e98
- SHA1 edbcdf9a1ef1def591b6b51749a277f18519cace
- SHA512 c64c45f4943d88aad4ee274c2b0ad76096a92a8ea184fbabad0de3e52c0c93a9ad3848a7ace398193a95937949220a30234c31e92bcabc1ad07d1b83a2dfc25d
- SSDEEP 24576:YZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:jY2fF8FhmS86IUJWQn+6h27d6
- TLSH T1AE657B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\f398d7926d1cde4f82be1b974bdb19aad9ff3b8196c27cd7604db8511f95b7fa.exe
- Size 353KB
- SHA256 98dc2c1e340c6da6a9ff619f368e9b27b12a2853cd06b229fc0739837c538cf6
- MD5 be89e1c81ae44f01b77c1c1be9486faa
- SHA1 cb317468b340a8c6eada7e9d16079c3aa9ac5b31
- SHA512 9eeda0cf6e7b968c7bf8cd33d02388e69d47610cc44cd51a955baf743ef89f9f52ee7f8737b23694678e11c7113bc8e70fd121e0c7e1516267a27fb38a59b657
- SSDEEP 6144:7xXYNt45SvibADn0ofR7JxNwqdfNqWVqQfIcbXr1VJCIA6srTZbRO:7xCL0QJTEWVqQfISxVJCIApO
- TLSH T12A743A127790C436C26235764A57DEB5A6AEBD235E2353477BD03F3FBE301919A2830A
- MD5 SHA1 SHA512 SSDEEP TLSH