2d32d15ae6b10b11850cf1e610c64960d7e0a29398d2ff6a9f014b21179c07b6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2d32d15ae6b10b11850cf1e610c64960d7e0a29398d2ff6a9f014b21179c07b6.exe
Size 42KB
Sample260910-nl61aasdmc
SHA256 2d32d15ae6b10b11850cf1e610c64960d7e0a29398d2ff6a9f014b21179c07b6
MD5 51a3e8792317db1b769826915265c444
SHA1 5ad0c9624994136ac0a7ca0ffcf6e30b40b9954a
SHA512 80e927ef5a869a0b94280e309920316e959b3ec02f427da01daaf8b807c865a35c6d4d925f9f680e0ad81d6cf5577f963497cc445d9687d9a7c5948761b42baa
SSDEEP 384:S4H4zr3/4hQzuRpa+HsnKJcF5rUH830ydsBUChjJTQTZAk3gzcx9ymbezBbfOutS:BYz7/4houzaLKJ5ZmATQTZAk31A7U
TLSH
T1C013522E3BAAB4E3D73686746CB595C56333B860BE51478B3850534E8C23B8CDD97B24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	2d32d15ae6b10b11850cf1e610c64960d7e0a29398d2ff6a9f014b21179c07b6.exe

Executes dropped EXE 1 IoCs

pid	Process
2412	ymjrx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d32d15ae6b10b11850cf1e610c64960d7e0a29398d2ff6a9f014b21179c07b6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ymjrx.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 2412	3184	2d32d15ae6b10b11850cf1e610c64960d7e0a29398d2ff6a9f014b21179c07b6.exe	87

C:\Users\Admin\AppData\Local\Temp\2d32d15ae6b10b11850cf1e610c64960d7e0a29398d2ff6a9f014b21179c07b6.exe
"C:\Users\Admin\AppData\Local\Temp\2d32d15ae6b10b11850cf1e610c64960d7e0a29398d2ff6a9f014b21179c07b6.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Users\Admin\AppData\Local\Temp\ymjrx.exe
  "C:\Users\Admin\AppData\Local\Temp\ymjrx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ymjrx.exe

Path C:\Users\Admin\AppData\Local\Temp\ymjrx.exe
Size 42KB
SHA256 88ffa37a206eb3e44194e5abd7f420866fcea74a5468466c284703804d9a35f3
MD5 1feccdc5154e8e9e7d12999dc107508a
SHA1 a0bd93ca08d6aba4d7839924680d38697c3ce0b1
SHA512 6990942aaaecdf9f8a4d76a178f003d1b0432d9d422e8ecbf296155e406c264379da8fe3abc36246212d985fc29e5813c4ab8999f077ceff4700ca220af2284d
SSDEEP 384:S4H4zr3/4hQzuRpa+HsnKJcF5rUH830ydsBUChjJTQTZAk3gzcx9ymbezBbfOut6:BYz7/4houzaLKJ5ZmATQTZAk31A7pO
TLSH
T10913622E3BAAB4E3D73686746CB595C56333B860BE51478B3850534E8C23B8CDD97B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download