Analysis
- max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
25/08/2026, 17:42
General
- Target 2a658fd5ac2743905309a510525d71207c0f4db736abcec7aa71de1029636cd7.exe
- Size 2.3MB
- Sample260825-wae2esxalg
- SHA256 2a658fd5ac2743905309a510525d71207c0f4db736abcec7aa71de1029636cd7
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a658fd5ac2743905309a510525d71207c0f4db736abcec7aa71de1029636cd7.exe"C:\Users\Admin\AppData\Local\Temp\2a658fd5ac2743905309a510525d71207c0f4db736abcec7aa71de1029636cd7.exe"1⤵
- Creates a file in the Startup directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\PROGRA~3\{BB656~1\2a658fd5ac2743905309a510525d71207c0f4db736abcec7aa71de1029636cd7.exeC:\PROGRA~3\{BB656~1\2A658F~1.EXE1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2a658fd5ac2743905309a510525d71207c0f4db736abcec7aa71de1029636cd7.exe
memory/1884-60-0x0000000004390000-0x0000000004391000-memory.dmp
memory/1884-62-0x00000000043B0000-0x00000000043B1000-memory.dmp
memory/1884-76-0x0000000003FB0000-0x0000000003FB1000-memory.dmp
memory/1884-79-0x0000000003FE0000-0x0000000003FE1000-memory.dmp
memory/1884-80-0x0000000004000000-0x0000000004001000-memory.dmp
memory/1884-81-0x0000000004360000-0x0000000004384000-memory.dmp
memory/1884-78-0x0000000003FD0000-0x0000000003FD1000-memory.dmp
memory/1884-71-0x0000000004C70000-0x0000000004C71000-memory.dmp
memory/1884-61-0x00000000043A0000-0x00000000043A1000-memory.dmp
memory/1884-70-0x0000000004C20000-0x0000000004C4F000-memory.dmp
memory/1884-69-0x0000000004C60000-0x0000000004C61000-memory.dmp
memory/1884-68-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/1884-66-0x0000000004C00000-0x0000000004C01000-memory.dmp
memory/1884-67-0x0000000004C10000-0x0000000004C11000-memory.dmp
memory/1884-77-0x0000000003FC0000-0x0000000003FC1000-memory.dmp
memory/1884-57-0x0000000003F30000-0x0000000003F31000-memory.dmp
memory/1884-75-0x0000000004C80000-0x0000000004C81000-memory.dmp
memory/1884-85-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/1884-63-0x00000000043C0000-0x00000000043C1000-memory.dmp
memory/1884-64-0x00000000043D0000-0x00000000043D1000-memory.dmp
memory/1884-65-0x00000000043E0000-0x00000000043E1000-memory.dmp
memory/1884-58-0x0000000003F40000-0x0000000003F41000-memory.dmp
memory/1884-59-0x0000000003F60000-0x0000000003F61000-memory.dmp
memory/1884-53-0x0000000001B20000-0x0000000001B21000-memory.dmp
memory/1884-54-0x0000000001B30000-0x0000000001B31000-memory.dmp
memory/1884-55-0x0000000001B40000-0x0000000001B41000-memory.dmp
memory/1884-56-0x0000000001B70000-0x0000000001B71000-memory.dmp
memory/1884-51-0x0000000001B00000-0x0000000001B01000-memory.dmp
memory/1884-52-0x0000000001B10000-0x0000000001B11000-memory.dmp
memory/1884-50-0x0000000001AF0000-0x0000000001AF1000-memory.dmp
memory/1884-49-0x0000000001AE0000-0x0000000001AE1000-memory.dmp
memory/1884-48-0x0000000001490000-0x0000000001491000-memory.dmp
memory/3896-17-0x00000000042A0000-0x00000000042A1000-memory.dmp
memory/3896-45-0x0000000004220000-0x0000000004221000-memory.dmp
memory/3896-34-0x0000000004FD0000-0x0000000004FF4000-memory.dmp
memory/3896-28-0x0000000004B50000-0x0000000004B51000-memory.dmp
memory/3896-29-0x0000000004F80000-0x0000000004F81000-memory.dmp
memory/3896-30-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/3896-31-0x0000000004FA0000-0x0000000004FA1000-memory.dmp
memory/3896-32-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
memory/3896-33-0x0000000004FC0000-0x0000000004FC1000-memory.dmp
memory/3896-27-0x0000000004B40000-0x0000000004B41000-memory.dmp
memory/3896-23-0x0000000004AF0000-0x0000000004B1F000-memory.dmp
memory/3896-22-0x0000000004B30000-0x0000000004B31000-memory.dmp
memory/3896-20-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/3896-21-0x0000000004B20000-0x0000000004B21000-memory.dmp
memory/3896-14-0x0000000004270000-0x0000000004271000-memory.dmp
memory/3896-15-0x0000000004280000-0x0000000004281000-memory.dmp
memory/3896-16-0x0000000004290000-0x0000000004291000-memory.dmp
memory/3896-6-0x0000000001520000-0x0000000001521000-memory.dmp
memory/3896-18-0x00000000042B0000-0x00000000042B1000-memory.dmp
memory/3896-19-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
memory/3896-13-0x0000000004260000-0x0000000004261000-memory.dmp
memory/3896-9-0x0000000001BF0000-0x0000000001BF1000-memory.dmp
memory/3896-10-0x0000000001C00000-0x0000000001C01000-memory.dmp
memory/3896-11-0x0000000001C10000-0x0000000001C11000-memory.dmp
memory/3896-12-0x0000000003E30000-0x0000000003E31000-memory.dmp
memory/3896-8-0x0000000001560000-0x0000000001561000-memory.dmp
memory/3896-7-0x0000000001530000-0x0000000001531000-memory.dmp
memory/3896-0-0x0000000000DC0000-0x0000000000DC1000-memory.dmp
memory/3896-1-0x0000000000DD0000-0x0000000000DD1000-memory.dmp
memory/3896-2-0x0000000000DE0000-0x0000000000DE1000-memory.dmp
memory/3896-3-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
memory/3896-4-0x00000000014B0000-0x00000000014B1000-memory.dmp
memory/3896-5-0x0000000001510000-0x0000000001511000-memory.dmp