85c939e9627e568f037d29caa4b264a03a76ab62c711dadbf5c716dbf68dda8c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
85c939e9627e568f037d29caa4b264a03a76ab62c711dadbf5c716dbf68dda8c.exe
Size 36KB
Sample260903-lem8gsel5x
SHA256 85c939e9627e568f037d29caa4b264a03a76ab62c711dadbf5c716dbf68dda8c
MD5 ada7dcd7faf1335bf37533d88b3a38bc
SHA1 d1849295f75aeebd9f16774cf3276222df8488be
SHA512 7b846fee55d8715b887a296096185f77797897011472761d8b69315fc88cf5e40ea5c32f2056d11294a91e2a01fa85bc838b4a464f62cf9f5756a3042237f403
SSDEEP 384:yVxXVXdFo873WyzLeReRPGnnNlHbCSoPoU7B3AmEm0dRTaB3hk1xsdMabIg:sXXdFD7NiGENlHuwmIdxy3hku6g
TLSH
T181F2C01E6EA74857F6A28DB4D3EA85D69FFD2D1735AB783FCF04440104C428C9892EB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHttp = "C:\\Users\\Admin\\AppData\\Local\\WinHttp.exe"	regedit.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85c939e9627e568f037d29caa4b264a03a76ab62c711dadbf5c716dbf68dda8c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinHttp.exe

Runs .reg file with regedit 1 IoCs

pid	Process
5428	regedit.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
3908	85c939e9627e568f037d29caa4b264a03a76ab62c711dadbf5c716dbf68dda8c.exe
2900	WinHttp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 5428	3908	85c939e9627e568f037d29caa4b264a03a76ab62c711dadbf5c716dbf68dda8c.exe	86

C:\Users\Admin\AppData\Local\Temp\85c939e9627e568f037d29caa4b264a03a76ab62c711dadbf5c716dbf68dda8c.exe
"C:\Users\Admin\AppData\Local\Temp\85c939e9627e568f037d29caa4b264a03a76ab62c711dadbf5c716dbf68dda8c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:5428

C:\Users\Admin\AppData\Local\WinHttp.exe
C:\Users\Admin\AppData\Local\WinHttp.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX3D92.tmp

Path C:\Users\Admin\AppData\Local\RCX3D92.tmp
Size 36KB
SHA256 38479b1868f987c7bde1a70fe60d5dae406036bf5d6231ef657686752ff9e9b5
MD5 fcdeae6bda23e3c2ad3d87eff190ac9d
SHA1 8eac3b525b04b60f5a1c3c70fd003fa3ab392717
SHA512 9180a1abd81c00928a990e533c6fda9f2e5ba30cfb8281c3ef3f985dd93408a83d65b3e06582d6c92717495f63a6ec0fb79c572dd714b24e8181c2e2857b286f
SSDEEP 384:yVxXBja3WyzLeReRmnnvmlDHLchWgBYfCNtki01KuNKjV5h/g:sreNixOlTLchWgeCR0gF5lg
TLSH
T121F2AE1E2DA71847F1868E70D7EA8ACA0FFC6D1739ABB83FCF44504504E954CA992DB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~dfds3.reg

Path C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
Size 166B
SHA256 767009fb8726500a4bc54b2ee744cc3ada64fdf16a44e22ff9dfe7652e2a439f
MD5 f44153ef26be29552cf320325ad8b72e
SHA1 74ac72ba2ff0f871e59b11c95ad707372662370c
SHA512 1d42a4dba1d8d0df9f8fedfba384ffdbcff3103c8ba360f255b5d7e8a46128f40521e4d16cf6de04365b3b6ffad8bc681cf7042d92867ab3d912601a3d5e6e65
TLSH
T100C08051D811B331F9D0B50446155992E7F3435D3DEB5740404495C569D128EC23D0F7
MD5 SHA1 SHA512 TLSH

Submit Download

WinHttp.exe

Path C:\Users\Admin\AppData\Local\WinHttp.exe
Size 36KB
SHA256 04e8c8405514ad3fe64f6eab3df50d6e27500af2d114a92b2fb4e205bcd1ac7b
MD5 f323e19c12b6f050ff3418c754bd548f
SHA1 606085eee6ccd5dc0ec40a72c3da7b34c4d01a51
SHA512 f6922d4236c76827c59bf43e11d44ec09e0a83c648caabec2a469a77b3264ce755b235c5d1e4b7cfbb145b05a2320847a0c91e55106e3119b242730574f390aa
SSDEEP 384:yVxXBja3WyzLeReRmnnNlHbCSoPoU7B3AmEm0dRTaB3hk1xsdMabIg:sreNixNlHuwmIdxy3hku6g
TLSH
T11EF2C00E6EA75403F6A289B5D3EA89C59FFD6C13359B783FCF04404210D429C88E2EB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2900-8-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3908-0-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3908-17-0x0000000000400000-0x0000000000409000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads