Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/08/2026, 10:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe
- Size 6KB
- Sample260827-mxrjasstat
- SHA256 e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b
- MD5 cb846f07256dcd236a0f8cd67d4f2821
- SHA1 4800b0ee0e97dc4547beae9d312fe6ea50417965
- SHA512 82757e006e1d6fd2484c78d3749499dabb114281f18ed6a076db46c816ca3d6564268cc81a57260f6a17444f649508e78463a31dede28e8b21673bf5987f193a
- SSDEEP 192:nouWDimO2fZMnZwcUEPWj8s5WZYqx/0SW:nju5UHWj8s5WZYqx
- TLSH T138D1F9039BAA4D1DFCB60B70227E9763612DFD288F66439F6357A22D3979481C870726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\nslookup.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\odbcconf.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\subst.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\cacls.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\cmdl32.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\convert.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\ctfmon.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\SystemUWPLauncher.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\TokenBrokerCookies.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\user.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\userinit.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\attrib.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\PING.EXE e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\RdpSaProxy.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\rdrleakdiag.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\rundll32.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\shutdown.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\wextract.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\help.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\setx.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\BackgroundTransferHost.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\compact.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\msdt.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\SecEdit.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\WerFaultSecure.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\winrs.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\fsutil.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\MuiUnattend.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\ReAgentc.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\EaseOfAccessDialog.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\instnm.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\raserver.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\TCPSVCS.EXE e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\wusa.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\WWAHost.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\charmap.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\regini.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\relog.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesProtection.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\w32tm.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\CameraSettingsUIHost.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\CloudNotifications.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\dllhst3g.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\MRINFO.EXE e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\quickassist.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\typeperf.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\wecutil.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\dllhost.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\colorcpl.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\lodctr.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\sethc.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\UserAccountControlSettings.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\fontdrvhost.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\OposHost.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\PackagedCWALauncher.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\SysWOW64\runas.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\explorer.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\HelpPane.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\hh.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\notepad.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\splwow64.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\winhlp32.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\write.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe File opened for modification C:\Windows\bfsvc.exe e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe"C:\Users\Admin\AppData\Local\Temp\e276ba7fedb45f7782f114f3d1c98300da03a8e25b4ae4bdc617dd05c689ba5b.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4492