Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 13:33
Behavioral task
behavioral1
Sample
c3279f95efb86dc134fdc336242a0095ee0ac1297525f959f6f0571ec49cbd54.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
General
- Target c3279f95efb86dc134fdc336242a0095ee0ac1297525f959f6f0571ec49cbd54.exe
- Size 8.1MB
- Sample260831-qtzx2sshjb
- SHA256 c3279f95efb86dc134fdc336242a0095ee0ac1297525f959f6f0571ec49cbd54
- MD5 6fb24825941f0d163dadcdbbb244ec62
- SHA1 0b1158dae207636992487c8c69fcc26ad667f039
- SHA512 f9d7939fa9031405ef76a82183ade730d3cfe57550523afae40bd3d49daea4b1acb292e6b50b3d693ba7591627eb7c019bb7c69ba203c40af41d44a26811cf70
- SSDEEP 196608:Q3IgiF6dW4DV8Jsc+hM+na5qPBZI27lqq6BvC:Q35iodW4posHhG5qPB2q0
- TLSH T16D863307D98242B1FAF2C032B936E537EF2469124912CD5F9FBABE9D91F5AB0154D203
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5748-0-0x0000000000400000-0x00000000012BA000-memory.dmp upx behavioral2/memory/5748-2-0x0000000000400000-0x00000000012BA000-memory.dmp upx behavioral2/memory/5748-3-0x0000000000400000-0x00000000012BA000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c3279f95efb86dc134fdc336242a0095ee0ac1297525f959f6f0571ec49cbd54.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5748 c3279f95efb86dc134fdc336242a0095ee0ac1297525f959f6f0571ec49cbd54.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5748 c3279f95efb86dc134fdc336242a0095ee0ac1297525f959f6f0571ec49cbd54.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5748 c3279f95efb86dc134fdc336242a0095ee0ac1297525f959f6f0571ec49cbd54.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3279f95efb86dc134fdc336242a0095ee0ac1297525f959f6f0571ec49cbd54.exe"C:\Users\Admin\AppData\Local\Temp\c3279f95efb86dc134fdc336242a0095ee0ac1297525f959f6f0571ec49cbd54.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5748
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004EC1⤵PID:5992