be4cf3baa682e1a1fe97ecd0bae298c08cc8ba8af0a15386f01be02f2ca1e97b

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 07:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be4cf3baa682e1a1fe97ecd0bae298c08cc8ba8af0a15386f01be02f2ca1e97b.exe
Size 1.5MB
Sample260831-h3thmaxbjc
SHA256 be4cf3baa682e1a1fe97ecd0bae298c08cc8ba8af0a15386f01be02f2ca1e97b
MD5 9366fd19ff7c95a7127392e2eb98c3e5
SHA1 38a6bfb78d8874e053363225e56e7ea7d9be3668
SHA512 330ef3a1698c5c45033150e51d1764fc3f89be7ffb5dd30f402b159754fa6258c9dc5d9d9bd8e551aa90e0abd9ccccbd1f76af4eeacb419e2e6b050388d5a718
SSDEEP 49152:SR6UzGAwNw9/9/MuifYJNLODFhhYPAtp5p:gJZ
TLSH
T1217518627A885333E2E322B1D58ED3E5531D90B4633721D762C9859C3760DA34BBF6E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be4cf3baa682e1a1fe97ecd0bae298c08cc8ba8af0a15386f01be02f2ca1e97b.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5552	be4cf3baa682e1a1fe97ecd0bae298c08cc8ba8af0a15386f01be02f2ca1e97b.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5552	be4cf3baa682e1a1fe97ecd0bae298c08cc8ba8af0a15386f01be02f2ca1e97b.exe

C:\Users\Admin\AppData\Local\Temp\be4cf3baa682e1a1fe97ecd0bae298c08cc8ba8af0a15386f01be02f2ca1e97b.exe
"C:\Users\Admin\AppData\Local\Temp\be4cf3baa682e1a1fe97ecd0bae298c08cc8ba8af0a15386f01be02f2ca1e97b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

launcher_config.ini

Path C:\Users\Admin\AppData\Local\Temp\launcher_config.ini
Size 348B
SHA256 75e1cf65e7718e5adf3b070f9e92baef0fa2fe6430657c92f6dc8a209a9bdb4f
MD5 2fae40e0fa25c2716a0383a413abe20f
SHA1 6a6d0a9548c99fa87e7ca3fe2aa58243072dc1ad
SHA512 c4e26d3860f06ace0941c49fb6a0d63d390a2542035437290e95f127c6007e1fe11f33959507651d500c55a5d5021e0a0cb5e40c134d84c387d342d0e817593d
TLSH
T1BFE02DC00E002402E076E0A8E8B31FC1E0AAB00A88C15074FF3846DD1ABE43C02D8A07
MD5 SHA1 SHA512 TLSH

Submit Download