1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba.exe
Size 1.2MB
Sample260827-tktw8axfmc
SHA256 1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba
MD5 5d6dab38d65b52fd7111fd8c35cd7d42
SHA1 481627e5f6f8b392a8ca40916143ebb92c5ce749
SHA512 3ad8f542321db9a2f4808aec781bc8a69c9edeb1b4a4528506384b88ac54e0fc231a39eccefae6f61ecb82d47c1a39477d07589b95b7669e71e449e174c3058c
SSDEEP 24576:Ruv9tG4rC7pQ1Rp7te0gDsHgaeMGNsHG6VfSnnCj6qs+JvD7IdeW:+NhDNhUG7W
TLSH
T1E155D013C3C09B37C692603D3A6FB62D95ABB54F32A3AA44A60755FF5D762C324243C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Wine	1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Wine	1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba.exe
Key opened	\REGISTRY\MACHINE\Software\Wine	1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4132	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4028	timeout.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1252	1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba.exe
1252	1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 4132	1252	1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba.exe	89
PID 4132 wrote to memory of 4028	4132	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba.exe
"C:\Users\Admin\AppData\Local\Temp\1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba.exe"
1⤵
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout 3 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1252-0-0x0000000000400000-0x000000000223B000-memory.dmp

Download

memory/1252-1-0x0000000000400000-0x000000000223B000-memory.dmp

Download

memory/1252-2-0x0000000000400000-0x0000000000508000-memory.dmp

Download

memory/1252-3-0x0000000000400000-0x000000000223B000-memory.dmp

Download

memory/1252-4-0x0000000000400000-0x0000000000508000-memory.dmp

Download

memory/1252-6-0x0000000000400000-0x000000000223B000-memory.dmp

Download

memory/1252-8-0x0000000000400000-0x000000000223B000-memory.dmp

Download

memory/1252-9-0x0000000000400000-0x0000000000508000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads