02239c01bd5c597df19b652a5cef709423b11c4e859a059d56478747f9764a15

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02239c01bd5c597df19b652a5cef709423b11c4e859a059d56478747f9764a15.exe
Size 36KB
Sample260907-heflvsfc58
SHA256 02239c01bd5c597df19b652a5cef709423b11c4e859a059d56478747f9764a15
MD5 dd951de2af20b0cec57eb35958667b5a
SHA1 b3e33735a8bcc113afbae0ce8a475e8563ceb14c
SHA512 63f1a33d30ac487f0df2ef516e86d921c5bc0452fe709e6806fa68a8e3a8007c8cd360736fc5a8ef0e72e7991cd73d58fb89a3442166887cf5476f4548ba2653
SSDEEP 384:yVxXJRxXL3WyzLeReRTnnDh9+HOYXnZN86+tizRvpqIICmgItXGp2pIFgg:s3RZLNiC19+uKnZN85ti5mgwI1Fgg
TLSH
T1CBF29E2E1D5B6047F5A64930E7E648D69FFC6D6378EABA3FCF25000124E414889D1EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHttp = "C:\\Users\\Admin\\AppData\\Local\\WinHttp.exe"	regedit.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinHttp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02239c01bd5c597df19b652a5cef709423b11c4e859a059d56478747f9764a15.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2716	regedit.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
3588	02239c01bd5c597df19b652a5cef709423b11c4e859a059d56478747f9764a15.exe
4360	WinHttp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 2716	3588	02239c01bd5c597df19b652a5cef709423b11c4e859a059d56478747f9764a15.exe	84

C:\Users\Admin\AppData\Local\Temp\02239c01bd5c597df19b652a5cef709423b11c4e859a059d56478747f9764a15.exe
"C:\Users\Admin\AppData\Local\Temp\02239c01bd5c597df19b652a5cef709423b11c4e859a059d56478747f9764a15.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:2716

C:\Users\Admin\AppData\Local\WinHttp.exe
C:\Users\Admin\AppData\Local\WinHttp.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:4360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX60BA.tmp

Path C:\Users\Admin\AppData\Local\RCX60BA.tmp
Size 36KB
SHA256 88ac3192d19ab49924b9805bd8a2689cfe41c72acf93e418a0f0d27271d45cd2
MD5 a8d8ab74d3da2b83cf39771bb18c6d43
SHA1 484941e9b9159ddea28d7ca91ba4db4380da10ca
SHA512 fe842b47813176ddb5a6f52e2474c00ac456f5a27e7077f8ac7e3901d0c1a22d80bd98245be1c85d018fa07bb97225bd009bb7e526d4579a2b47163d9d6d2e40
SSDEEP 384:yVxXKneNch83WyzLeReRcnn1LpkXZUMFzVGFgzzs3Ruab+lPXrM1g:sAneuh8Nib1AFzVCMo3caIXrM1g
TLSH
T14DF29E1E6D9B505BF2129E30C6EA95CAAFFD2D1B34EB683FCF51510105E005C8591EF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~dfds3.reg

Path C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
Size 166B
SHA256 767009fb8726500a4bc54b2ee744cc3ada64fdf16a44e22ff9dfe7652e2a439f
MD5 f44153ef26be29552cf320325ad8b72e
SHA1 74ac72ba2ff0f871e59b11c95ad707372662370c
SHA512 1d42a4dba1d8d0df9f8fedfba384ffdbcff3103c8ba360f255b5d7e8a46128f40521e4d16cf6de04365b3b6ffad8bc681cf7042d92867ab3d912601a3d5e6e65
TLSH
T100C08051D811B331F9D0B50446155992E7F3435D3DEB5740404495C569D128EC23D0F7
MD5 SHA1 SHA512 TLSH

Submit Download

WinHttp.exe

Path C:\Users\Admin\AppData\Local\WinHttp.exe
Size 36KB
SHA256 38e6299f84ecd95cffb9758019c2fc78cddf4f81697e64eaccc7126252aea028
MD5 dd545c46ae7f1615a94b2c71dea4ac69
SHA1 b544b30152a03c7c07536164955af29d00071131
SHA512 e20467c6c2ada55767a018c5b27592beb550c3d173b5482e8853fd955782fdccaa4c41e6deb2547b12e226d2e4948ea00651305e9c52fc01a53b5fbf3830d006
SSDEEP 384:yVxXKneNch83WyzLeReRcnnDh9+HOYXnZN86+tizRvpqIICmgItXGp2pIFgg:sAneuh8Nib19+uKnZN85ti5mgwI1Fgg
TLSH
T1FEF29E2E1D9B6043F5A68D30D7EA48DA9FFC6D6378EA793FDF25100114E41988891EF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3588-0-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3588-18-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4360-16-0x0000000000400000-0x0000000000409000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads