304fab6d756d267e0e5c43609969afc125624ccde2b6845d314511d00f6a4512

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
304fab6d756d267e0e5c43609969afc125624ccde2b6845d314511d00f6a4512.exe
Size 32KB
Sample260910-n8cd7abp91
SHA256 304fab6d756d267e0e5c43609969afc125624ccde2b6845d314511d00f6a4512
MD5 a1de4c0f3cea20351aee4d883597ee24
SHA1 09f7d32ad9b098fec4d90e1bacb79396ec968e90
SHA512 222df80a493cd7a2ef4cb72384924c9e40ccc2fa128e9fd46e14b4f8874cd329773acb110c04665f0d9d2ba996e188ab129730fb12494d6b3ef7101fc412d01b
SSDEEP 384:PMJD+1/AMX2U6P9lkyAP9Ep6jtmi/pEojGrnrX7gnZUcvJblCC:oD+FhXN6jRMtlRERP7v01lCC
TLSH
T14DE253F9EBD70A71E3778AF695F791B36825B02EEC124D4C40D137640C23A529C6DE4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	304fab6d756d267e0e5c43609969afc125624ccde2b6845d314511d00f6a4512.exe

Executes dropped EXE 1 IoCs

pid	Process
4280	firefox_update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	304fab6d756d267e0e5c43609969afc125624ccde2b6845d314511d00f6a4512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	firefox_update.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 4280	2000	304fab6d756d267e0e5c43609969afc125624ccde2b6845d314511d00f6a4512.exe	85

C:\Users\Admin\AppData\Local\Temp\304fab6d756d267e0e5c43609969afc125624ccde2b6845d314511d00f6a4512.exe
"C:\Users\Admin\AppData\Local\Temp\304fab6d756d267e0e5c43609969afc125624ccde2b6845d314511d00f6a4512.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\firefox_update.exe
  "C:\Users\Admin\AppData\Local\Temp\firefox_update.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

firefox_update.exe

Path C:\Users\Admin\AppData\Local\Temp\firefox_update.exe
Size 33KB
SHA256 2f0a6a491231a9110ddedf0c84f376ba689ee8212975fb6136d76037b8269551
MD5 16af4ab8df19a7eda4ded9dc443aebee
SHA1 6d493f054f6af70ec4b7ec53dce4080fded03a41
SHA512 67c7324c935420e06c7ef0186388558590efdb23bf91ef988f8a30f6260d78f2efdd34b6b0baeea7a0b850c52f396ce1c7dc00cb1f98548fa7272fec06df8a3c
SSDEEP 384:PMJD+1/AMX2U6P9lkyAP9Ep6jtmi/pEojGrnrX7gnZUcvJblCh:oD+FhXN6jRMtlRERP7v01lCh
TLSH
T1DDE263F9EBD70A71E3778AF695F791B36825B02EEC124D4C40D237640C23A529C6DE4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2000-0-0x0000000000403000-0x0000000000405000-memory.dmp

Download

memory/4280-9-0x0000000000400000-0x0000000000408000-memory.dmp