32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe
Size 84KB
Sample260831-t7capawfle
SHA256 32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105
MD5 74e665b999587c3e2484d4c7b4e288b6
SHA1 e68dadfadfad0025ccda74b635ab6fdcea3803c3
SHA512 28da937a472c6b2a17b1575fe96cca291b4be45bcbb49a946ffa725b3b082ef23e0d29c43c66add67374480c9b138baf19421fb2b56c8158a8e687a9afcf9cc6
SSDEEP 1536:/Zi59VSuW3Ip+4xxpB0TsY6Dq5UbF5bLrAntJkz:96xfuX6DqWF9nAc
TLSH
T1AD839E0FF90780F1F36761B149DBDABF4471B5068433BABAFF0A4A69F572241291A217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1480	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe

Executes dropped EXE 1 IoCs

pid	Process
1480	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3984 set thread context of 4736	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 4736	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	85
PID 3984 wrote to memory of 4736	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	85
PID 3984 wrote to memory of 4736	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	85
PID 3984 wrote to memory of 4736	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	85
PID 3984 wrote to memory of 4736	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	85
PID 3984 wrote to memory of 4736	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	85
PID 3984 wrote to memory of 4736	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	85
PID 3984 wrote to memory of 4736	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	85
PID 3984 wrote to memory of 4736	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	85
PID 3984 wrote to memory of 4736	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	85
PID 3984 wrote to memory of 4736	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	85
PID 3984 wrote to memory of 4736	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	85
PID 3984 wrote to memory of 4736	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	85
PID 3984 wrote to memory of 4736	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	85
PID 3984 wrote to memory of 4736	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	85
PID 3984 wrote to memory of 1480	3984	32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe	87

C:\Users\Admin\AppData\Local\Temp\32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe
"C:\Users\Admin\AppData\Local\Temp\32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Users\Admin\AppData\Local\Temp\32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe
  "C:\Users\Admin\AppData\Local\Temp\32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe"
  2⤵
  PID:4736
- C:\Users\Admin\AppData\Local\Temp\32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe
  C:\Users\Admin\AppData\Local\Temp\32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe delete
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe

Path C:\Users\Admin\AppData\Local\Temp\32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105.exe
Size 84KB
SHA256 32677bbfb5b05858cd29f9e47706884f26ce36149b68a5fa8205b19112d88105
MD5 74e665b999587c3e2484d4c7b4e288b6
SHA1 e68dadfadfad0025ccda74b635ab6fdcea3803c3
SHA512 28da937a472c6b2a17b1575fe96cca291b4be45bcbb49a946ffa725b3b082ef23e0d29c43c66add67374480c9b138baf19421fb2b56c8158a8e687a9afcf9cc6
SSDEEP 1536:/Zi59VSuW3Ip+4xxpB0TsY6Dq5UbF5bLrAntJkz:96xfuX6DqWF9nAc
TLSH
T1AD839E0FF90780F1F36761B149DBDABF4471B5068433BABAFF0A4A69F572241291A217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1480-11-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3984-10-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4736-0-0x0000000000400000-0x0000000000413000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads