9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7.exe
Size 12.1MB
Sample260910-311jdazvds
SHA256 9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7
MD5 b0801bedf9e0c904b10b50b4e38c0a07
SHA1 5ada9b8076fcf43939e41814cc4cb8773f105f48
SHA512 5b483cd00821f5f08e14f37e96ac7670e6806047568da4017dc7625fced1eb4e3744d4366b25cbf1666c2e8adad819f7f6e2e00a25c88e49ca826301d4761c5b
SSDEEP 196608:P5d2qcMZitRsyU5kQRu6FbZYH4FM7kop5XhiZXgKY80NC1Zgv43v+:PXo2hu6FbZbu7k0ARg3DCZ+
TLSH
T123D602E166149926F575E13BA261F7690C3715B2CA4AA190F078C8FCFBE33D11CE918B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5076	9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7.tmp

Loads dropped DLL 3 IoCs

pid	Process
5488	regsvr32.exe
3368	regsvr32.exe
424	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5904-0-0x0000000000C50000-0x0000000000D45000-memory.dmp	innosetup
behavioral2/memory/5904-23-0x0000000000C50000-0x0000000000D45000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5076	9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7.tmp
5076	9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7.tmp
5488	regsvr32.exe
5488	regsvr32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5076	9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5904 wrote to memory of 5076	5904	9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7.exe	89
PID 5076 wrote to memory of 5488	5076	9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7.tmp	90
PID 1132 wrote to memory of 3368	1132	regsvr32.exe	95
PID 6004 wrote to memory of 424	6004	regsvr32.exe	97

C:\Users\Admin\AppData\Local\Temp\9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7.exe
"C:\Users\Admin\AppData\Local\Temp\9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Users\Admin\AppData\Local\Temp\is-NCGSHLBKIQ.tmp\9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NCGSHLBKIQ.tmp\9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7.tmp" /SL5="$400B0,10558488,939008,C:\Users\Admin\AppData\Local\Temp\9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32.exe" /s /u "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\c3fd1746_2633_4c06_97ab_1e11d88a9185.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5488

C:\Windows\system32\regsvr32.exe
regsvr32.exe
1⤵
PID:3580

C:\Windows\system32\regsvr32.exe
"regsvr32.exe" /s /u "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\c3fd1746"_"2633"_"4c06"_"97ab"_"1e11d88a9185.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\regsvr32.exe
  /s /u "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\c3fd1746"_"2633"_"4c06"_"97ab"_"1e11d88a9185.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3368

C:\Windows\system32\regsvr32.exe
"regsvr32.exe" /s /u "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\c3fd1746"_"2633"_"4c06"_"97ab"_"1e11d88a9185.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Windows\SysWOW64\regsvr32.exe
  /s /u "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\c3fd1746"_"2633"_"4c06"_"97ab"_"1e11d88a9185.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-NCGSHLBKIQ.tmp\9e63c3fcedbfe5f72b32fa92e5e236e25502e8645093e2ca200b177c3374e5b7.tmp
Size 3.6MB
SHA256 5d3a2556c59488bf52ef3345a38d1c4282f368fa2dfd3d0a1e86dcc96017ef23
MD5 ee2bfad0699ede97e0ebf5587edb1d05
SHA1 a4a958e0b3329098782b8768a089742e5d2a4c1d
SHA512 e696430c6893d6b649de1080c1bf589a1bdb8135c6d410766ea17a4749fc88ba3e92e85339e8eaa7667db572e92af1876f3f6205cd30582437b67068531f8f8f
SSDEEP 49152:P3SA9I3bZxTZElVySH6UNoO7zjQynN4s7UUZyE8eECaN2Mt333wZ4:PCbWroSkynN4sQ+TdMt333L
TLSH
T1F3068D13B388643FD06B1A395837BA54583F7A7229168C675BF40E8C8F752842E3A777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3fd1746_2633_4c06_97ab_1e11d88a9185.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\c3fd1746_2633_4c06_97ab_1e11d88a9185.dll
Size 4.5MB
SHA256 d9a5345c4c9d929e63a489c1538e94ac3b26283d4d263f909709628303dadb9d
MD5 b5510bf0e2250c1e55f3dd9528034dde
SHA1 a06f4d2a2482a25ac739f77001cff84cbed69579
SHA512 2eb9f8e2fd6fda99045b81336d6052f2a18299f6a31ee998e623b5927538661eebdd5c5c97021df497ae0676fee3686e3f70958989f92bf73b4c2403e9ad3581
SSDEEP 98304:KPthpjJpqfPLQzp/2+yU/Ek8EOi+PD5Rpr9+n+oOLdzwEE:KPthpjJkfPLQzp/2+yBkmimD3pr9+naS
TLSH
T1F4268E11E5606975CE9B1530106FE33BE6305F24803ACA9BCF799E94BBFF791A848607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5076-11-0x0000000003E10000-0x0000000003F50000-memory.dmp

Download

memory/5076-9-0x0000000003E10000-0x0000000003F50000-memory.dmp

Download

memory/5076-8-0x0000000003E10000-0x0000000003F50000-memory.dmp

Download

memory/5076-10-0x0000000003E10000-0x0000000003F50000-memory.dmp

Download

memory/5076-13-0x0000000003E10000-0x0000000003F50000-memory.dmp

Download

memory/5076-12-0x0000000003E10000-0x0000000003F50000-memory.dmp

Download

memory/5076-14-0x0000000003E10000-0x0000000003F50000-memory.dmp

Download

memory/5076-6-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Download

memory/5076-22-0x0000000000D20000-0x00000000010D0000-memory.dmp

Download

memory/5488-27-0x00000000749C0000-0x0000000074D84000-memory.dmp

Download

memory/5488-42-0x00000000749C0000-0x0000000074D84000-memory.dmp

Download

memory/5904-0-0x0000000000C50000-0x0000000000D45000-memory.dmp

Download

memory/5904-23-0x0000000000C50000-0x0000000000D45000-memory.dmp

Download