bf07124f6a146811209b2beb0f1d4b3b3ce4bb2f36c831ab7b03ffd8d05d5443

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/08/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
myhororlex pc.exe
Size 92KB
Sample260826-mp2pasxapf
SHA256 bf07124f6a146811209b2beb0f1d4b3b3ce4bb2f36c831ab7b03ffd8d05d5443
MD5 b6c110c94bcccdd6b72b84aa8abe6e82
SHA1 a8f6f1ebc217eb6716a3ce8c14dfa1dafd2bcbd6
SHA512 31db85475ed69c2929458d4fac54a43d10dc40f871ecae1597a186e5fca9ec365d319b3f80e448047f817bfc6f1e2409639df5ed5715073e54777b4aebda0403
SSDEEP 1536:D7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfAwwBPwOi:f7DhdC6kzWypvaQ0FxyNTBfAHBP+
TLSH
T15F936D41F3E202F7EAF2053100A6722F973663389764A8DBC75C3D529913AD5A63D3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2884	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	myhororlex pc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5772 wrote to memory of 2884	5772	myhororlex pc.exe	81

C:\Users\Admin\AppData\Local\Temp\myhororlex pc.exe
"C:\Users\Admin\AppData\Local\Temp\myhororlex pc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E34.tmp\E35.tmp\E36.bat "C:\Users\Admin\AppData\Local\Temp\myhororlex pc.exe""
  2⤵
  - Executes a command shell one-liner
  PID:2884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E36.bat

Path C:\Users\Admin\AppData\Local\Temp\E34.tmp\E35.tmp\E36.bat
Size 3KB
SHA256 6271c42d3a5aa8fcd59e7f04ba94a69753b5ce52a4b02a19798addbe5f116e4e
MD5 42af4c960ae710097d9ea2a2141a9a56
SHA1 af7b7183b81e260a3c6a666057c6566eb9bb3833
SHA512 7dfa1251438bdd0b0e2852cc9ca0ba2ac765327aaf01f73e57de08874c1a2896636db3f867e18e97c0577fbd8defff021f6e53014feea68f068bd0f21088d2ed
TLSH
T1EB61D5928CAFF6448E6B4C919B9073CBF157C15ACC1E0721B52E362C544BC95B35AF4E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5772-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download