d9539a05e3617897ee6d96537f75bfe9dbac5c41df40950e1f4394c7fedb1678

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
coronabytes.net_ecx_rc2_2.exe
Size 189.6MB
Sample260907-vhtdca1fke
SHA256 d9539a05e3617897ee6d96537f75bfe9dbac5c41df40950e1f4394c7fedb1678
MD5 bca36deb5296a7582ae49bca22c96d41
SHA1 bcbde8afc2011bec052fce17f24b5e88b50f1593
SHA512 73fc71578b69d451e39f9861ceae022df97758c6da64c3dc5aba766490776cc86e0ca027d65a8c972bb0e8c4a179dab5a1a1f20c3dbf2197f07aca98c472746f
SSDEEP 3145728:Q8FwTYX8S1Nlk9/qEqVFoqWDsG7HyvRQoC4VRmX64vZzBZBHq3:zzXnG/NqYsG7HyvRRC4VMXXZVa
TLSH
T1029833381BD14514EB49E83D9BDBD4668DCA333EA95E3A7DE140311B9B78A0E3E27053
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4136	coronabytes.net_ecx_rc2_2.exe
4136	coronabytes.net_ecx_rc2_2.exe
4136	coronabytes.net_ecx_rc2_2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	coronabytes.net_ecx_rc2_2.exe

C:\Users\Admin\AppData\Local\Temp\coronabytes.net_ecx_rc2_2.exe
"C:\Users\Admin\AppData\Local\Temp\coronabytes.net_ecx_rc2_2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4136

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518 0x4ac
1⤵
PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdvSplash.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd8086.tmp\AdvSplash.dll
Size 6KB
SHA256 11f476a9a4e628492f9997ff8eb0f9e7765a94da64f3b5360dd5e0f030a8ccc2
MD5 54dfe6bcd54f2beb8b4983017dee29a0
SHA1 ab296e12041c60e055c313f486805f8aabdecc52
SHA512 d9890934b29b7dc6f8df1b03b95b9c497b960c8146ae87de22fcad1723505467e72553db66578cffd5655a1e5e4b4af7041a23c9d82b0698b1e9a677f654565d
SSDEEP 96:uQNyX2PtUZsM88eo93NaqqhN51xWabkkEkk/StCmwoo:uFXYt38B9V61dk/kkStCm
TLSH
T1C3C1C637B7C255F3C20A10B06C49766387A9993263E1601D1EA3A7CAB6E2857ED38743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BgImage.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd8086.tmp\BgImage.dll
Size 7KB
SHA256 6ac427991f039b0bf124276cc8dde7f25dadadd0116a7969c614084b5038680d
MD5 bfe899eaf20f6eac12b20671b6b9a591
SHA1 d8e9ee9c5852669218ae94f1c0d540c0b13cbf54
SHA512 c8160fa24bd1929f6293862d59f0d6c890d8f3d6105f0931c4ac6ca8ec4b927435ff46eec0ca1495dd7fdf7c1a620c9e4abab9ce60a47f728b1eddb122de55a8
SSDEEP 96:UuJQGDD6lKsLcLGRpHZwlkxYWaSsZL5JRzn1zDUsc:UumGDD6BgLGR4ZLjh1Usc
TLSH
T1C7E1C43773C294B3E3AE11B81C82275AF7BB981263005269093766D9AD94996FD64E03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd8086.tmp\System.dll
Size 10KB
SHA256 802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
MD5 fe24766ba314f620d57d0cf7339103c0
SHA1 8641545f03f03ff07485d6ec4d7b41cbb898c269
SHA512 60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
SSDEEP 192:rO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1aMBgMO:yKAFERdlxhGRYUzqZaMB
TLSH
T18E226C5547A041F3DD60823C08973D272BA837148EA54ED3CFD314429E296A6BCBC336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads