snojan | 23cac1b20f74baae5ad0d9a9cea45b45f84802d89ab8e21f91747d6c66d7fb6c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
23cac1b20f74baae5ad0d9a9cea45b45f84802d89ab8e21f91747d6c66d7fb6c.exe
Size 172KB
Sample260910-lp88ps1enf
SHA256 23cac1b20f74baae5ad0d9a9cea45b45f84802d89ab8e21f91747d6c66d7fb6c
MD5 5b5023e9b1a774d63f51c5308c2d3546
SHA1 ecbf09342864605fbd1cb9ba55977ee1240b6db6
SHA512 94d0dad6732db38795090990176e4b31fcfd49dbf005590f772a194c7e572b9c4f09f627fdcef11304d25ec89f9783b6548b25b95e264ae1b17af3f005a5247c
SSDEEP 3072:zs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/E/FnncrBPh1:zDeM7iNEkgiOb31k1ECSJu51
TLSH
T107045C20A998E4F3E8A301F105445B716E71DD35161ACA83E3D6EF79A9B4311DB8C3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader snojan upx

Malware Config

Extracted

Family

snojan

http://wecan.hasthe.technology/upload

Signatures

Family: Snojan
Snojan is a downloader used to drop and execute other malware.
downloader snojan

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5044-0-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/5044-1-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/files/0x00030000000006fd-6.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23cac1b20f74baae5ad0d9a9cea45b45f84802d89ab8e21f91747d6c66d7fb6c.exe

C:\Users\Admin\AppData\Local\Temp\23cac1b20f74baae5ad0d9a9cea45b45f84802d89ab8e21f91747d6c66d7fb6c.exe
"C:\Users\Admin\AppData\Local\Temp\23cac1b20f74baae5ad0d9a9cea45b45f84802d89ab8e21f91747d6c66d7fb6c.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rifaien2-rqcQrTiFurJRMs22.exe

Path C:\Users\Admin\AppData\Local\Temp\rifaien2-rqcQrTiFurJRMs22.exe
Size 172KB
SHA256 9e9658adb5a73032a2f41d66f3e087caa14c8d1e17c92226397170b5b4813546
MD5 dc0aa665665bd674b644ea8048dd11da
SHA1 a8fcd8bd1b8d8c7324c7b92bc6b125d39953be19
SHA512 2f4dd8f87cc631e88fb8d776d1483269402e31784d572a3c1ec1d2dca84100215d932e55a210e7885f774f7700dfc5316cf8d24f5e4b3cb0d6ed0072aa672862
SSDEEP 3072:zs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/P/FnncrBPh1:zDeM7iNEkgiOb31k1ECvJu51
TLSH
T161045C20A998E4F3E8A301F105445B716E71DD35161ACA83E3D6EF79A9B4311DB8C3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5044-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/5044-1-0x0000000000400000-0x000000000042B000-memory.dmp