02e8972bf5cfd85f89ddc8f403eceee2a3c99749592043d550ecd4654940a529

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02e8972bf5cfd85f89ddc8f403eceee2a3c99749592043d550ecd4654940a529.exe
Size 40KB
Sample260907-ja7efsfe63
SHA256 02e8972bf5cfd85f89ddc8f403eceee2a3c99749592043d550ecd4654940a529
MD5 f0c06ad1491bbcc8ea28d401a24b3ee2
SHA1 c9e63d07f09796b1f1764735e89e1bf7108006bd
SHA512 3a871d29f51d7317a0c2475873ffd6571ad697bede0a6d2f2551216243480163199ed6b8e3c8d60a46adad1b9ab61ed8d0e24a8c7a642cc141b39301564ceab5
SSDEEP 384:R4xUgwyg9mjkWy4MfyzLeReRqn/wFAzsSASQI2Or13A5D4LK4EDAqH09OgLKFGLn:e23ShFiOS3Ac2OxwN1Aq09ORF29Ar6
TLSH
T114039D0C6EA75117F1924930E7E686FA9FFD6C23759BB87FCF41D00610A50ACA492DB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHttp = "C:\\Users\\Admin\\AppData\\Local\\WinHttp.exe"	regedit.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02e8972bf5cfd85f89ddc8f403eceee2a3c99749592043d550ecd4654940a529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinHttp.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3552	regedit.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
3748	02e8972bf5cfd85f89ddc8f403eceee2a3c99749592043d550ecd4654940a529.exe
1168	WinHttp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 3552	3748	02e8972bf5cfd85f89ddc8f403eceee2a3c99749592043d550ecd4654940a529.exe	84

C:\Users\Admin\AppData\Local\Temp\02e8972bf5cfd85f89ddc8f403eceee2a3c99749592043d550ecd4654940a529.exe
"C:\Users\Admin\AppData\Local\Temp\02e8972bf5cfd85f89ddc8f403eceee2a3c99749592043d550ecd4654940a529.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:3552

C:\Users\Admin\AppData\Local\WinHttp.exe
C:\Users\Admin\AppData\Local\WinHttp.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:1168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX2F59.tmp

Path C:\Users\Admin\AppData\Local\RCX2F59.tmp
Size 40KB
SHA256 705a5c78ea914450137a7f36df7137fa7c3bed6a8cafe9a00677d47b5337ec25
MD5 b2c6230012bf63c339b4bc841de60fc3
SHA1 c3deb271abc37d68acbc2767c3bb9ed08a58734c
SHA512 8a4b790fb81a8fd02875182e55e11ea649c7e01da374c063df17c56cdc195eaf00f75297b816c0dc338ca5cc89d09a092ce8cb8b525851015b69640fcc54e511
SSDEEP 384:R4xUgE3QkjEVy4MfyzLeReR1nFah1a3k0l9cNLgISrVr6xAekVJZ6LE6:e0QxVFiXhEfdVZNV6E6
TLSH
T11303B10D1EA76907F1824D34D2EA86F99FFDAC17789B783FDF44E05014C51A898A2EB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~dfds3.reg

Path C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
Size 166B
SHA256 767009fb8726500a4bc54b2ee744cc3ada64fdf16a44e22ff9dfe7652e2a439f
MD5 f44153ef26be29552cf320325ad8b72e
SHA1 74ac72ba2ff0f871e59b11c95ad707372662370c
SHA512 1d42a4dba1d8d0df9f8fedfba384ffdbcff3103c8ba360f255b5d7e8a46128f40521e4d16cf6de04365b3b6ffad8bc681cf7042d92867ab3d912601a3d5e6e65
TLSH
T100C08051D811B331F9D0B50446155992E7F3435D3DEB5740404495C569D128EC23D0F7
MD5 SHA1 SHA512 TLSH

Submit Download

WinHttp.exe

Path C:\Users\Admin\AppData\Local\WinHttp.exe
Size 40KB
SHA256 12d164d656317d57542780d8f88f18e7f49dd9eea42065fc641427e72d47b803
MD5 768fdec6eb4e100c4a08d16bd3c8debd
SHA1 7055fe5a05189fca90bbbe746396a0389c09dc8e
SHA512 de13826a3327ba89d5e711e545dff19c05cff6de23ef80df427c7132911e15f526e8efc75bbd15fc94cf1f7e621b81a0465291dacf64b42b64eeef99c6d4a457
SSDEEP 384:R4xUgE3QkjEVy4MfyzLeReR1n/wFAzsSASQI2Or13A5D4LK4EDAqH09OgLKFGLiQ:e0QxVFiJS3Ac2OxwN1Aq09ORF29Ar6
TLSH
T1C9038C1C5EA75117F1924970E3E686FA8FFD6C2375AB787FCF81D00110A51ACA492EB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1168-16-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/3748-0-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/3748-17-0x0000000000400000-0x000000000040A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads