e7db86dfa1bf84dacf52f64c37bd33954ba9fc5349c0a873073ec3d875c62ed9

Analysis

max time kernel
149s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e7db86dfa1bf84dacf52f64c37bd33954ba9fc5349c0a873073ec3d875c62ed9.exe
Size 75KB
Sample260908-ej4ygacm4s
SHA256 e7db86dfa1bf84dacf52f64c37bd33954ba9fc5349c0a873073ec3d875c62ed9
MD5 c602f4888c52de00beed27a1dd70bd41
SHA1 3dab10dea83f9369bd19d12239b2b25cc8e7030a
SHA512 234c62bc4b21a42ab56fff008aa5059b9bc4d1bd820d49bf635e24861bbec4a3bc3e677dee2c6bee9407a447f3c814fbde8518e3b1727344168928b2ba6bc194
SSDEEP 1536:WjAkZVrTDN20R+/rTs0NSOFulpVq00le/:YAkZ5XN20R+jTs0NSOFu/w00k
TLSH
T1D7737D066F5F1102F45B4E70C6A2D1A6CEB9BCE23AAA11DFD720C5453EA17E04536B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1472	e7db86dfa1bf84dacf52f64c37bd33954ba9fc5349c0a873073ec3d875c62ed9.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7db86dfa1bf84dacf52f64c37bd33954ba9fc5349c0a873073ec3d875c62ed9.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 1472	2864	e7db86dfa1bf84dacf52f64c37bd33954ba9fc5349c0a873073ec3d875c62ed9.exe	86

C:\Users\Admin\AppData\Local\Temp\e7db86dfa1bf84dacf52f64c37bd33954ba9fc5349c0a873073ec3d875c62ed9.exe
"C:\Users\Admin\AppData\Local\Temp\e7db86dfa1bf84dacf52f64c37bd33954ba9fc5349c0a873073ec3d875c62ed9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\Temp\e7db86dfa1bf84dacf52f64c37bd33954ba9fc5349c0a873073ec3d875c62ed9.exe
  "C:\Users\Admin\AppData\Local\Temp\e7db86dfa1bf84dacf52f64c37bd33954ba9fc5349c0a873073ec3d875c62ed9.exe"
  2⤵
  - Executes dropped EXE
  PID:1472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e7db86dfa1bf84dacf52f64c37bd33954ba9fc5349c0a873073ec3d875c62ed9.exe

Path C:\Users\Admin\AppData\Local\Temp\e7db86dfa1bf84dacf52f64c37bd33954ba9fc5349c0a873073ec3d875c62ed9.exe
Size 43KB
SHA256 a20c35eafc4f2085eb51ec9a778034cd1a3a64544611f1696cb3ac41106eddd1
MD5 66b42283b8cf9ff5b88b9f1c068869a0
SHA1 ac00d2c6fb87d3317bfe3c173a2486e1d036109f
SHA512 c153b34a46136defd807832b0ae8615c6716a7e7ac11a55e1bce221fd84b1ebbcf68d07667d611b5de7d3efc811e3f3c90a2ad8947e008ff396b659a55e15964
SSDEEP 768:G20zV+/r/TaOsOZu176PNLMfd7OFuo8pGonVIbp23+zjle/:G20R+/rTs0NSOFulpVq00le/
TLSH
T121136C435F5D1496F55B8AB4C5E2D227DDB4BDE07BA611CF0030D2852FA27E0263AB2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download