Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 08:13
General
- Target 1b5e9a951f818caa65d88c5e160f36430d4f66d636d7ebea2fb02b553a59232f.exe
- Size 61KB
- Sample260910-j4prhazgnd
- SHA256 1b5e9a951f818caa65d88c5e160f36430d4f66d636d7ebea2fb02b553a59232f
- MD5 b5d51c2cfe1f9d8f927f0369e48d807f
- SHA1 73830ce0ea25b6cf2735781078e05e600f5cf5ac
- SHA512 cabd08c2001ffff26ad62ce58d4ee43e3c06737ed4b4e07a97f20116e6e008aed9bce3842f157829fd0d32f994caa08592f62018bde4aa18ee1e3f2d1b6ac354
- SSDEEP 1536:heenLT0m0aCtE4VE7jQBZNFqRohMRo2GX4VbuYTTFyme8mjs:heyv0K6E4Vaj6Z/62qmgf0Qmjs
- TLSH T16D53F22F9E6E4D6BFD334C39820FBB2215B6A618E41B175405D93089FC96738EC59BB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/4032-0-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/4032-3-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/4032-4-0x0000000000400000-0x000000000043B000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1b5e9a951f818caa65d88c5e160f36430d4f66d636d7ebea2fb02b553a59232f.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4032 1b5e9a951f818caa65d88c5e160f36430d4f66d636d7ebea2fb02b553a59232f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b5e9a951f818caa65d88c5e160f36430d4f66d636d7ebea2fb02b553a59232f.exe"C:\Users\Admin\AppData\Local\Temp\1b5e9a951f818caa65d88c5e160f36430d4f66d636d7ebea2fb02b553a59232f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4032