2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e.exe
Size 369KB
Sample260910-nzllhagf96
SHA256 2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e
MD5 17fddf06f50070501fa334c065955b8d
SHA1 332e5e39763664f93389b829a4bb770ea37683d7
SHA512 c7f2b75aed10779e8beb377b187d1c2c30f9f214c965d131f17e5476531db15c82bc7ae7870d1a715dfe4561e38d7656750d64f4dce7a396a5e3d8d0fb6e8a82
SSDEEP 6144:7Drk+N8TMyv8v7gzbV0w8bhMeVOTFVLPdCtHBNu:7sC8d8v7Ph9McOTHbEH3
TLSH
T1FA84120763E208B6E073463569A67334F4A7EF601F24989FFB288E5D8FD29748865317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3744	dMOBpxtENxl.exe

Executes dropped EXE 4 IoCs

pid	Process
5104	dMOBpxtENxl.exe
3744	dMOBpxtENxl.exe
4340	dMOBpxtENxl.exe
4508	dMOBpxtENxl.exe

Loads dropped DLL 6 IoCs

pid	Process
4108	2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e.exe
4108	2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e.exe
3744	dMOBpxtENxl.exe
3744	dMOBpxtENxl.exe
4508	dMOBpxtENxl.exe
4508	dMOBpxtENxl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qyDJcaStNQHAXFs = "C:\\ProgramData\\QFD3uhOXp4bz3nAK\\dMOBpxtENxl.exe"	2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3024 set thread context of 4108	3024	2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e.exe	85
PID 5104 set thread context of 3744	5104	dMOBpxtENxl.exe	87
PID 4340 set thread context of 4508	4340	dMOBpxtENxl.exe	90
PID 3744 set thread context of 2668	3744	dMOBpxtENxl.exe	92
PID 4508 set thread context of 2616	4508	dMOBpxtENxl.exe	94

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dMOBpxtENxl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dMOBpxtENxl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeCollabSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FullTrustNotifier.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dMOBpxtENxl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dMOBpxtENxl.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 4108	3024	2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e.exe	85
PID 3024 wrote to memory of 4108	3024	2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e.exe	85
PID 4108 wrote to memory of 5104	4108	2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e.exe	86
PID 5104 wrote to memory of 3744	5104	dMOBpxtENxl.exe	87
PID 5104 wrote to memory of 3744	5104	dMOBpxtENxl.exe	87
PID 4340 wrote to memory of 4508	4340	dMOBpxtENxl.exe	90
PID 4340 wrote to memory of 4508	4340	dMOBpxtENxl.exe	90
PID 4508 wrote to memory of 3004	4508	dMOBpxtENxl.exe	91
PID 3744 wrote to memory of 2668	3744	dMOBpxtENxl.exe	92
PID 3744 wrote to memory of 2668	3744	dMOBpxtENxl.exe	92
PID 4508 wrote to memory of 2616	4508	dMOBpxtENxl.exe	94
PID 4508 wrote to memory of 2616	4508	dMOBpxtENxl.exe	94

C:\Users\Admin\AppData\Local\Temp\2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e.exe
"C:\Users\Admin\AppData\Local\Temp\2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e.exe
  "C:\Users\Admin\AppData\Local\Temp\2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\ProgramData\QFD3uhOXp4bz3nAK\dMOBpxtENxl.exe
    "C:\ProgramData\QFD3uhOXp4bz3nAK\dMOBpxtENxl.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\ProgramData\QFD3uhOXp4bz3nAK\dMOBpxtENxl.exe
      "C:\ProgramData\QFD3uhOXp4bz3nAK\dMOBpxtENxl.exe"
      4⤵
      Deletes itself
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3744
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" /i:3744
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2668

C:\ProgramData\QFD3uhOXp4bz3nAK\dMOBpxtENxl.exe
C:\ProgramData\QFD3uhOXp4bz3nAK\dMOBpxtENxl.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4340
- C:\ProgramData\QFD3uhOXp4bz3nAK\dMOBpxtENxl.exe
  C:\ProgramData\QFD3uhOXp4bz3nAK\dMOBpxtENxl.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe" /i:4508
    3⤵
    PID:3004
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" /i:4508
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX4AC0.tmp

Path C:\ProgramData\QFD3uhOXp4bz3nAK\RCX4AC0.tmp
Size 369KB
SHA256 fd6e2108d3cf9596fac818073d935e125474d66ab27373e5ec1c06be74d2ddc6
MD5 fc74c00fc21dcc6ccbd30b3a0778ee08
SHA1 086cd84782eee82bccd92d093c7075d748d0b10f
SHA512 ce23cd3c82d5c9323fbf803d97794318020fb3a8a0a7402bab4c67e6995c14eded97d41aa3990a9b3129d9b2073f2290812bb8543d91972dffee142df7fa071e
SSDEEP 6144:7Drk+NcwXse7GWHoadJitEV3lKvgniDVQ2DBB:7sCTXse7GWHoa/oE6tQUB
TLSH
T17784126AB5E14C32F02505345EC4B231FA73BEA05F3A5AEF63260F6E0E5D2D41898397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dMOBpxtENxl.exe

Path C:\ProgramData\QFD3uhOXp4bz3nAK\dMOBpxtENxl.exe
Size 369KB
SHA256 2f1fc91c046904a1dee67900d6755dce3730cf3ed8bb31c45c0a4fd784cf4e5e
MD5 17fddf06f50070501fa334c065955b8d
SHA1 332e5e39763664f93389b829a4bb770ea37683d7
SHA512 c7f2b75aed10779e8beb377b187d1c2c30f9f214c965d131f17e5476531db15c82bc7ae7870d1a715dfe4561e38d7656750d64f4dce7a396a5e3d8d0fb6e8a82
SSDEEP 6144:7Drk+N8TMyv8v7gzbV0w8bhMeVOTFVLPdCtHBNu:7sC8d8v7Ph9McOTHbEH3
TLSH
T1FA84120763E208B6E073463569A67334F4A7EF601F24989FFB288E5D8FD29748865317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2616-63-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2616-59-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2668-50-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3024-0-0x000000000042D000-0x000000000042E000-memory.dmp

Download

memory/3024-4-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/3744-53-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3744-26-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4108-20-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4108-5-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4108-3-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4108-2-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4108-1-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4340-40-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/4508-39-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4508-54-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4508-62-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5104-21-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/5104-28-0x0000000000400000-0x0000000000468000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads