2b439458afd035d562acd04c3c407b22f03f4bf8c2be6593c2f2ae003e1f2364

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2b439458afd035d562acd04c3c407b22f03f4bf8c2be6593c2f2ae003e1f2364.exe
Size 1.2MB
Sample260825-tyv2fasthy
SHA256 2b439458afd035d562acd04c3c407b22f03f4bf8c2be6593c2f2ae003e1f2364
MD5 029cb60badead7b579bf20b53ffb7111
SHA1 8bcca8895ba32ba0dbe9a73fa624e6876151206b
SHA512 ac08af6867dce0490ae00b37671af224430ddfe611060c66708eb774a8d8a3162dc10ae448f5db91475a526d1a3c7ea15fc89fd7f86db76d39e5909b040de0f8
SSDEEP 24576:4Jr8tE+IXs6SPkql7FSYD7tyl2IrlfcuhKuDT/5fp:4J4cUPkqFSYtKfcoKABB
TLSH
T11F552312BDC0C572C57014B41FF29B72693C7D212B654EEB63682B2E6E351D0963BBA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	2b439458afd035d562acd04c3c407b22f03f4bf8c2be6593c2f2ae003e1f2364.exe

Executes dropped EXE 2 IoCs

pid	Process
4684	Shellbag Analyzer.exe
2660	shellbag_analyzer_cleaner (2).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shellbag_analyzer_cleaner (2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2b439458afd035d562acd04c3c407b22f03f4bf8c2be6593c2f2ae003e1f2364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shellbag Analyzer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2660	shellbag_analyzer_cleaner (2).exe
2660	shellbag_analyzer_cleaner (2).exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 4684	4624	2b439458afd035d562acd04c3c407b22f03f4bf8c2be6593c2f2ae003e1f2364.exe	88
PID 4624 wrote to memory of 2660	4624	2b439458afd035d562acd04c3c407b22f03f4bf8c2be6593c2f2ae003e1f2364.exe	90

C:\Users\Admin\AppData\Local\Temp\2b439458afd035d562acd04c3c407b22f03f4bf8c2be6593c2f2ae003e1f2364.exe
"C:\Users\Admin\AppData\Local\Temp\2b439458afd035d562acd04c3c407b22f03f4bf8c2be6593c2f2ae003e1f2364.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\Shellbag Analyzer.exe
  "C:\Users\Admin\AppData\Local\Temp\Shellbag Analyzer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4684
- C:\Users\Admin\AppData\Local\Temp\shellbag_analyzer_cleaner (2).exe
  "C:\Users\Admin\AppData\Local\Temp\shellbag_analyzer_cleaner (2).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Shellbag Analyzer.exe

Path C:\Users\Admin\AppData\Local\Temp\Shellbag Analyzer.exe
Size 407KB
SHA256 13f41585d022bc4cc901f6010f8ef61770b02598fa441d33868b19b7b4ff8280
MD5 e4e9dd645d31d2787a4dc1c3013ebd73
SHA1 b70870e8c0c51759ee870ada81fe98ba9a86e3d5
SHA512 3fbc9b6451107183bf4b337206591a6a7680b18104725fa5090735a23b913344d7457c3c7162d092fda9aa5ecd5b8183785b6b1e531732efc9b72c6bb1174900
SSDEEP 6144:+TouKrWBEu3/Z2lpGDHU3ykJyT+tjs/Pi7bleLQaps3:+ToPWBv/cpGrU3yDT+tjIPi7bGQp3
TLSH
T1FA94D003BDC195B2C42208335B296B61693DBE202F658EEBB7D42E1DDA311D0E7357B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shellbag_analyzer_cleaner (2).exe

Path C:\Users\Admin\AppData\Local\Temp\shellbag_analyzer_cleaner (2).exe
Size 1.6MB
SHA256 c93a0f4c6b5f24ee31cddb92b0ea3337021b5fb91faae8a381d3bd2c9b6add54
MD5 463058236a0d84f8f8982d946eed0e07
SHA1 800ab71ed3b3bf4fb67fc9e1628e59d0aab8b124
SHA512 18bd9aea8489c5e873a679da92c83d2739de9532f5751bd23aea9eda226b9a95909f8fd525b0ce47859492997002aee32ecf37bb79e07f24b512287b8fd58a53
SSDEEP 24576:HM33oPhoNsZ8IbF1lyDt3Ups4yAg7UrA2ei9QgTum+ApT:sHogIJD2y9oIreG
TLSH
T1DF757D22A681843FC02236389C5B86E965F9BF112E346D7B3AAD7C4C4F7728135E61D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2660-21-0x00000000004F9000-0x00000000004FA000-memory.dmp

Download

memory/2660-22-0x0000000000400000-0x0000000000572000-memory.dmp

Download

memory/2660-23-0x0000000000400000-0x0000000000572000-memory.dmp

Download

memory/2660-24-0x0000000000400000-0x0000000000572000-memory.dmp

Download

memory/2660-25-0x0000000000400000-0x0000000000572000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads