5629e5be34bec1d4a080ab8ef4a36de20be8ad66a69743a556b6a167209fb7c9

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 07:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5629e5be34bec1d4a080ab8ef4a36de20be8ad66a69743a556b6a167209fb7c9.exe
Size 36KB
Sample260907-jvpedasblc
SHA256 5629e5be34bec1d4a080ab8ef4a36de20be8ad66a69743a556b6a167209fb7c9
MD5 7b44344c95e7f3064f3ea3b9595a4dd2
SHA1 65549cd78c889953e98383a62d1f3eb28d1f2e34
SHA512 0cbc5e192bec569b604119e8bd084a8aa21db54cf6ebb070d0181732879a982bbe7db64ba0158a234281232ace464521e7d510677971be0311c730a213dae8dc
SSDEEP 384:KrxUgPERL0k9y4OyzLeReRWnngSMtQH14q8xOATxufE/XSqAVvAyebg1g:eVaL0KTithMtEl8xOHEPW1F1g
TLSH
T101F2AE1A5D9B4617F1964E35D3EA89C69FFC6C47399BB97FCF58200210E008C8991DF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHttp = "C:\\Users\\Admin\\AppData\\Local\\WinHttp.exe"	regedit.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5629e5be34bec1d4a080ab8ef4a36de20be8ad66a69743a556b6a167209fb7c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinHttp.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3132	regedit.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
1668	5629e5be34bec1d4a080ab8ef4a36de20be8ad66a69743a556b6a167209fb7c9.exe
872	WinHttp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 3132	1668	5629e5be34bec1d4a080ab8ef4a36de20be8ad66a69743a556b6a167209fb7c9.exe	85

C:\Users\Admin\AppData\Local\Temp\5629e5be34bec1d4a080ab8ef4a36de20be8ad66a69743a556b6a167209fb7c9.exe
"C:\Users\Admin\AppData\Local\Temp\5629e5be34bec1d4a080ab8ef4a36de20be8ad66a69743a556b6a167209fb7c9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:3132

C:\Users\Admin\AppData\Local\WinHttp.exe
C:\Users\Admin\AppData\Local\WinHttp.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX313D.tmp

Path C:\Users\Admin\AppData\Local\RCX313D.tmp
Size 36KB
SHA256 b6c521844c714b04f032d6f406cea51f5d2959ffa274cb698d7944ba62e3690a
MD5 55c4713846fcd2d467ad1c8ad8fba950
SHA1 ec36ddf61d822d4728e095e03a58e6ab5c37038c
SHA512 43b182b671cddef81023060e14275c723d1caaa26a23d1b69055e45d31f66911146a7f50f99ffcdb258fc3f38050a937690881cb28f5373250e43876f261ade4
SSDEEP 384:KrxUgzNy4OyzLeReRVnnyoe++//p490Wxe91EcFLh6AH8zhn0O0EG508g:e3Ti0yoepx49+4y4AKhn08GK8g
TLSH
T117F2AE2E6E975847F6A65D30D3EA49C25FFDAC233AAA797FCF54104100D008C95A1EF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~dfds3.reg

Path C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
Size 166B
SHA256 767009fb8726500a4bc54b2ee744cc3ada64fdf16a44e22ff9dfe7652e2a439f
MD5 f44153ef26be29552cf320325ad8b72e
SHA1 74ac72ba2ff0f871e59b11c95ad707372662370c
SHA512 1d42a4dba1d8d0df9f8fedfba384ffdbcff3103c8ba360f255b5d7e8a46128f40521e4d16cf6de04365b3b6ffad8bc681cf7042d92867ab3d912601a3d5e6e65
TLSH
T100C08051D811B331F9D0B50446155992E7F3435D3DEB5740404495C569D128EC23D0F7
MD5 SHA1 SHA512 TLSH

Submit Download

WinHttp.exe

Path C:\Users\Admin\AppData\Local\WinHttp.exe
Size 36KB
SHA256 b241aa4279ee9196b35ffa15ee5acb27b1aed802516c5ebd19a25c81303b94a6
MD5 a731a9156308fa51ffd1dc45b8206954
SHA1 97a56aafa33817cdb14487933a78143e08dd27fe
SHA512 fe93cd1585b055d28cee9be01d07acf84285a011582c365774c67d00788440faf50ca926cd84a2b5e2ff4dc8992b464c676d1d91b2c9a89ab57ca876b369a4b2
SSDEEP 384:KrxUgzNy4OyzLeReRVnngSMtQH14q8xOATxufE/XSqAVvAyebg1g:e3Ti0hMtEl8xOHEPW1F1g
TLSH
T104F2AF1E5E9B9517F0968971D3EA89C65FFD6C07369BBA3FCF58100210E009C85A1EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-8-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1668-0-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1668-17-0x0000000000400000-0x0000000000409000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads