b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe
Size 8.9MB
Sample260826-tcl7eaeb48
SHA256 b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d
MD5 eeef7b1336873934fa11752e55923e66
SHA1 b207bbd0fac52f013adf48b65834d628485e7a56
SHA512 2746074681b239451b252713c5950f19db7d471c904385f2c8a7890a1dd91907e4ee0180503bed08c5a80b4e1a6cafa6f528506d4b9acddb4468f9601f781b46
SSDEEP 196608:lvLdHguoHua5LxNyJoQ6DxrpgbfLr7daUE26zG6ILi7urjKmk:7dWDpxNyKQ6lpYxQfp4KT
TLSH
T12A962345F56A40B2C2561970282B66BFD9784E420B25CBE75398CF2D3F332B1963B376
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4516	b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe

Loads dropped DLL 1 IoCs

pid	Process
3428	calc.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Program crash 2 IoCs

pid	pid_target	Process	procid_target
13240	3428	WerFault.exe	86
13188	3428	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4356	b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4356	b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe
4356	b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe
4516	b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe
4516	b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 4516	4356	b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe	85
PID 4516 wrote to memory of 3428	4516	b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe	86
PID 4356 wrote to memory of 1940	4356	b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe	87

C:\Users\Admin\AppData\Local\Temp\b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe
"C:\Users\Admin\AppData\Local\Temp\b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Users\Admin\AppData\Local\Temp\b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe
  C:\Users\Admin\AppData\Local\Temp\b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe 5
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\SysWOW64\calc.exe
    C:\Windows\system32\calc.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3428
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 536
      4⤵
      Program crash
      PID:13188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 340
      4⤵
      Program crash
      PID:13240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\csqeqe.temp"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3428 -ip 3428
1⤵
PID:13164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3428 -ip 3428
1⤵
PID:13220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe

Path C:\Users\Admin\AppData\Local\Temp\b819c447eca9f08b54199e9cc31f12758903a13554dafff50246c1068225108d.exe
Size 8.9MB
SHA256 c4a02e90049b1847a3543027bd5c05e3a295d6547aaab252697f4cd185d48245
MD5 76ee36ec054b49052e8341c66ce6293d
SHA1 a55f53e42644e46edb51780113c36f25181b38ef
SHA512 a69889c918c4f2ec8944cbbab9357e7b4fecd0a9893ac8f1c8264c3e0c1aeea70d5f140c06ae1a470ead727787e6709cb573e125a8d41bce4992e53797e7e38e
SSDEEP 196608:lvLdHguoHua5LxNyJoQ6DxrpgbfLr7daUE26zG6ILi7urjKmB:7dWDpxNyKQ6lpYxQfp4KG
TLSH
T11C962345F56A40B2C2561970282B66BFD9784E420B25CBE75398CF2D3F332B1963B376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

115454.dll

Path C:\Users\Admin\AppData\Local\Temp\qie2016\115454.dll
Size 4.3MB
SHA256 9ab9c06a418e550dced5ccdf90cd9ff3b1fa654781142aae9b59a6d041e30a02
MD5 af3356d5c0a7ad2af98227fbe997cf0b
SHA1 8b3ecdeeb49b54fea55c107dfc15beb4c5c16919
SHA512 a945119c3892433bf36a332263cc378f71b39260674255063b989bd458c4b15dfc7a44e8b11555df1edd553ebcec34f5b506f947ac65e67e6aa2e312f7204ed3
SSDEEP 98304:T0daGgw3oHua5s/4rUWxNPizEi/FoQ6DxrpQ:IdHguoHua5LxNyJoQ6DxrpQ
TLSH
T1772633C1EC3E2F32D1E719F1740AA5ADD4A80D8116B5C1FA03E24B597FB2379926A743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3428-10-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/3428-11-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/3428-9-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/3428-8-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/3428-14-0x0000000010000000-0x0000000010534000-memory.dmp

Download

memory/3428-17-0x00000000773A0000-0x00000000775B5000-memory.dmp

Download

memory/4356-0-0x0000000000400000-0x0000000000CEB000-memory.dmp

Download

memory/4356-1-0x000000000047D000-0x000000000047E000-memory.dmp

Download

memory/4356-16-0x0000000000400000-0x0000000000CEB000-memory.dmp

Download

memory/4516-6-0x0000000000400000-0x0000000000CEB000-memory.dmp

Download

memory/4516-15-0x0000000000400000-0x0000000000CEB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads