Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/09/2026, 03:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe
- Size 10.1MB
- Sample260907-dpxkxaed94
- SHA256 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3
- MD5 1c7dfbca9ebfaff2a48da2e21bbcfc83
- SHA1 a8b9ac77e81e7501316a0776b0c4fe5e1d4ead4a
- SHA512 193f48b7f02c15e535a5acf16c78ec816c6a8c4a4f0e393da39d313fbfcaaf32dacad2e7f2d80757f64b3120e1c1c27e2619f518be5eb519f0d8335aef5a545f
- SSDEEP 98304:e70Lwhw+I2kn5Ds6uipv4VJLP95LCiVzArOSqeDalc6dPUwkO:MI2UDs6oVr5hc9BDalrkO
- TLSH T164B6BF133520DC61E8440B77D1AA837C62391699A97AD08BF354BF6B7C341136F6EA2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2540 2904 238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe"C:\Users\Admin\AppData\Local\Temp\238498044cbbd64a5759e784da49862075658c734c81a48f0a16bb92204cbfc3.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=TXT yzmainapi.diguasoft.com2⤵
- System Location Discovery: System Language Discovery
PID:2540
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\E2EECore.2.7.2.dll
- Size 8.4MB
- SHA256 982a177924762f270b36fe34c7d6847392b48ae53151dc2011078dceef487a53
- MD5 8b6c94bbdbfb213e94a5dcb4fac28ce3
- SHA1 b56102ca4f03556f387f8b30e2b404efabe0cb65
- SHA512 9d6d63b5d8cf7a978d7e91126d7a343c2f7acd00022da9d692f63e50835fdd84a59a93328564f10622f2b1f6adfd7febdd98b8ddb294d0754ed45cc9c165d25a
- SSDEEP 98304:z0PpiCcXz5iqFaFxZkyE2kCeQ+LDSBRAN9ijNnQobT9wdxd+tNrspBAUZLh7ZV/T:QyDBaFxZNb+LwRAN9w1X9wdxrpV9/J
- TLSH T1B1968C00F7428166EDCE01B4516AA73D4539BE5407292AD3F34C3E6AAF31AD23F3665E
- MD5 SHA1 SHA512 SSDEEP TLSH