6b3c1a9ce2b07b731ac30cc3d20f0f86d042ff9376bb9c1e939666ecf778773b

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b3c1a9ce2b07b731ac30cc3d20f0f86d042ff9376bb9c1e939666ecf778773b.exe
Size 40KB
Sample260908-jtk1kavflf
SHA256 6b3c1a9ce2b07b731ac30cc3d20f0f86d042ff9376bb9c1e939666ecf778773b
MD5 61a0a3e351eb193d6de4bd44820e7e6b
SHA1 8a45cdde734e18edf864794fc3b3d452a15ec1f6
SHA512 cae6a26e89c3d3974c4403d5343943b857ec1a3ff87dce5896339fe7ab84dc6e0a7154cf6ac1b3a50c0e37fda8dcdd9f600cbf8f8702f2ede69eac8b3bf5d06f
SSDEEP 384:R4xUgtx5qU3ly4MfyzLeReRKn2xlMb2SpdNj5zEpTAeUMIKGzgYmXPBnKx6:eHbpVFivznJKEY/Bnc6
TLSH
T177039E1D5EAB885BF2428D75A3E655FAAFFC6C13759B346FCF84D18010D22888481EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHttp = "C:\\Users\\Admin\\AppData\\Local\\WinHttp.exe"	regedit.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinHttp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6b3c1a9ce2b07b731ac30cc3d20f0f86d042ff9376bb9c1e939666ecf778773b.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1480	regedit.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
2228	6b3c1a9ce2b07b731ac30cc3d20f0f86d042ff9376bb9c1e939666ecf778773b.exe
5076	WinHttp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1480	2228	6b3c1a9ce2b07b731ac30cc3d20f0f86d042ff9376bb9c1e939666ecf778773b.exe	87

C:\Users\Admin\AppData\Local\Temp\6b3c1a9ce2b07b731ac30cc3d20f0f86d042ff9376bb9c1e939666ecf778773b.exe
"C:\Users\Admin\AppData\Local\Temp\6b3c1a9ce2b07b731ac30cc3d20f0f86d042ff9376bb9c1e939666ecf778773b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:1480

C:\Users\Admin\AppData\Local\WinHttp.exe
C:\Users\Admin\AppData\Local\WinHttp.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:5076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX5F91.tmp

Path C:\Users\Admin\AppData\Local\RCX5F91.tmp
Size 40KB
SHA256 e574a2e680d2a419f44d711d0422be582c48bab73e3f96b066b232eb1011decb
MD5 89612e698755f842ca4b7d705ed34f0c
SHA1 2e5e3c4f1cc3848313009de9325324bece18fa76
SHA512 e2c093aaba05e87210bd07cb745cd9d58e5bfc68945508895922bcd668892daa842a9679fea1d95218bbcd2c5c71a26d2b7f183cf7027a49402cc5fe2ab74f67
SSDEEP 384:R4xUgxIiABy4MfyzLeReRQnrea+GiqiaVZykxP9TuzFjn3ZcrgV/ujzXq6:eblkFixhiaVRwRLZ1Iz66
TLSH
T1CC038E1D1D6B5443F2828E35E3AA55FA9FFD6D233A9B683FCF04D04114E059885A2EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~dfds3.reg

Path C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
Size 166B
SHA256 767009fb8726500a4bc54b2ee744cc3ada64fdf16a44e22ff9dfe7652e2a439f
MD5 f44153ef26be29552cf320325ad8b72e
SHA1 74ac72ba2ff0f871e59b11c95ad707372662370c
SHA512 1d42a4dba1d8d0df9f8fedfba384ffdbcff3103c8ba360f255b5d7e8a46128f40521e4d16cf6de04365b3b6ffad8bc681cf7042d92867ab3d912601a3d5e6e65
TLSH
T100C08051D811B331F9D0B50446155992E7F3435D3DEB5740404495C569D128EC23D0F7
MD5 SHA1 SHA512 TLSH

Submit Download

WinHttp.exe

Path C:\Users\Admin\AppData\Local\WinHttp.exe
Size 40KB
SHA256 6fb49de2163e27e6f91bbc31a06ab5f787462423e66bc0fffe403dd94c41500b
MD5 02f33092441862c9bc8453a750cff95a
SHA1 986bd2bef6efe46b8546ef5ea5e23b2af78737bb
SHA512 a231d9b4cf2cc1f8e053564894dfdb9745b772270185fb4aba727a6c539de7ec8fc8373d48c4219f45b6824813cc9332150d970a32750babce0524a9110b09bf
SSDEEP 384:R4xUgxIiABy4MfyzLeReRQn2xlMb2SpdNj5zEpTAeUMIKGzgYmXPBnKx6:eblkFiRznJKEY/Bnc6
TLSH
T139038D5D6EAB884BF2428D74E3E646FA9FFD6D13759B706FCF84D08010912888491EF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2228-0-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/2228-18-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/5076-9-0x0000000000400000-0x000000000040A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads