f48ee76e2dddaf182f9b1805f3f9acf43a8739219e81b0efe2a4a29ad5fce332

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f48ee76e2dddaf182f9b1805f3f9acf43a8739219e81b0efe2a4a29ad5fce332.exe
Size 26KB
Sample260826-red8gaxwht
SHA256 f48ee76e2dddaf182f9b1805f3f9acf43a8739219e81b0efe2a4a29ad5fce332
MD5 ddba20666a2680bdc7eb83c0241eeea6
SHA1 47f6bfe9524d3ab3e2cebd817cede622f0846b10
SHA512 517084ff12b859d07e0e3e5616caf7b2e1cf0541964363a41822334b19a7a9f8776e055bf426306edfb9b8662d04d7664272d6c3572842254eb72219a37713db
SSDEEP 384:Tb1eka/S2pzcJxIlUmwjod9BrXkRT265/lA3d1:9ee2pzcJxIiBTb/lAN1
TLSH
T102C2D5238FE24E78F7214AF128BA95B25436752DDFC616FF52CD263A50076D1B0F2A60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	f48ee76e2dddaf182f9b1805f3f9acf43a8739219e81b0efe2a4a29ad5fce332.exe

Executes dropped EXE 1 IoCs

pid	Process
2352	kbswl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f48ee76e2dddaf182f9b1805f3f9acf43a8739219e81b0efe2a4a29ad5fce332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kbswl.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 2352	5016	f48ee76e2dddaf182f9b1805f3f9acf43a8739219e81b0efe2a4a29ad5fce332.exe	84

C:\Users\Admin\AppData\Local\Temp\f48ee76e2dddaf182f9b1805f3f9acf43a8739219e81b0efe2a4a29ad5fce332.exe
"C:\Users\Admin\AppData\Local\Temp\f48ee76e2dddaf182f9b1805f3f9acf43a8739219e81b0efe2a4a29ad5fce332.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Local\Temp\kbswl.exe
  "C:\Users\Admin\AppData\Local\Temp\kbswl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kbswl.exe

Path C:\Users\Admin\AppData\Local\Temp\kbswl.exe
Size 26KB
SHA256 7fb42d3a3d259e12f8311baf82fa1a60e00a04aa47b8c3323756bdd78a8bcae6
MD5 3c721595b565a6acf147aee734415a4c
SHA1 27136a406bf5130171f5a649a809639ede2435b9
SHA512 f0ea0f187635e260f0c9cd3754d87e5b9dd4dc23c74b87213fd8ce74e2ac7b38ba21b04ec71c870805461aed3a8d5229c9f03427a0a144a6ee056fe6da72d123
SSDEEP 384:Tb1eka/S2pzcJxIlUmwjod9BrXkRT265/lA3dw:9ee2pzcJxIiBTb/lANw
TLSH
T1E3C2D5238FE24E78F3214AF168BA95B25436752DDFC616FF52CD263A40076D1B0F2A60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5016-0-0x0000000002070000-0x0000000002071000-memory.dmp

Download

memory/5016-11-0x0000000000400000-0x0000000000403000-memory.dmp