3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e.exe
Size 267KB
Sample260910-rhmn1syta1
SHA256 3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e
MD5 75a7f4edd783a7dfddfa39344129a059
SHA1 2d81e393f3c6ada08bdc7c5fdf4325e78237458c
SHA512 ca97a1dbced3d9053ad9e94e444452a04f98f2a0afd1a91b4b3a0ac7d9414a73658224e08a83fcee7fc188b0ee17b231b309d37635a691c9fb232fa4f2ecca7e
SSDEEP 6144:ixZug0YMFmgIMqUtzO4W1Nydrh6EDvAJM/5:iomgIMqU5uMdfxR
TLSH
T1FD44128E71C08335E5E859BA50CD72C4A777F26C4E2CDAF64C7218331D693A2A468E5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1832	G33X1xPEky4iB.exe

Executes dropped EXE 4 IoCs

pid	Process
4260	G33X1xPEky4iB.exe
1832	G33X1xPEky4iB.exe
536	G33X1xPEky4iB.exe
3812	G33X1xPEky4iB.exe

Loads dropped DLL 6 IoCs

pid	Process
2644	3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e.exe
2644	3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e.exe
1832	G33X1xPEky4iB.exe
1832	G33X1xPEky4iB.exe
3812	G33X1xPEky4iB.exe
3812	G33X1xPEky4iB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8a9ZdNTA1ArEcx = "C:\\ProgramData\\4jHKrN5Hjh32\\G33X1xPEky4iB.exe"	3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2064 set thread context of 2644	2064	3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e.exe	87
PID 4260 set thread context of 1832	4260	G33X1xPEky4iB.exe	89
PID 536 set thread context of 3812	536	G33X1xPEky4iB.exe	92
PID 3812 set thread context of 4176	3812	G33X1xPEky4iB.exe	93
PID 1832 set thread context of 4296	1832	G33X1xPEky4iB.exe	94

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G33X1xPEky4iB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G33X1xPEky4iB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G33X1xPEky4iB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G33X1xPEky4iB.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2644	2064	3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e.exe	87
PID 2064 wrote to memory of 2644	2064	3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e.exe	87
PID 2644 wrote to memory of 4260	2644	3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e.exe	88
PID 4260 wrote to memory of 1832	4260	G33X1xPEky4iB.exe	89
PID 4260 wrote to memory of 1832	4260	G33X1xPEky4iB.exe	89
PID 536 wrote to memory of 3812	536	G33X1xPEky4iB.exe	92
PID 536 wrote to memory of 3812	536	G33X1xPEky4iB.exe	92
PID 1832 wrote to memory of 4296	1832	G33X1xPEky4iB.exe	94
PID 3812 wrote to memory of 4176	3812	G33X1xPEky4iB.exe	93
PID 1832 wrote to memory of 4296	1832	G33X1xPEky4iB.exe	94
PID 3812 wrote to memory of 4176	3812	G33X1xPEky4iB.exe	93

C:\Users\Admin\AppData\Local\Temp\3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e.exe
"C:\Users\Admin\AppData\Local\Temp\3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e.exe
  "C:\Users\Admin\AppData\Local\Temp\3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\ProgramData\4jHKrN5Hjh32\G33X1xPEky4iB.exe
    "C:\ProgramData\4jHKrN5Hjh32\G33X1xPEky4iB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\ProgramData\4jHKrN5Hjh32\G33X1xPEky4iB.exe
      "C:\ProgramData\4jHKrN5Hjh32\G33X1xPEky4iB.exe"
      4⤵
      Deletes itself
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1832
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe" /i:1832
        5⤵
        
        PID:4296

C:\ProgramData\4jHKrN5Hjh32\G33X1xPEky4iB.exe
C:\ProgramData\4jHKrN5Hjh32\G33X1xPEky4iB.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:536
- C:\ProgramData\4jHKrN5Hjh32\G33X1xPEky4iB.exe
  C:\ProgramData\4jHKrN5Hjh32\G33X1xPEky4iB.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe" /i:3812
    3⤵
    PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

G33X1xPEky4iB.exe

Path C:\ProgramData\4jHKrN5Hjh32\G33X1xPEky4iB.exe
Size 267KB
SHA256 3ba0d87c9554dda1147e560552169ae129731af401eef1bebbcbc3da096bfa0e
MD5 75a7f4edd783a7dfddfa39344129a059
SHA1 2d81e393f3c6ada08bdc7c5fdf4325e78237458c
SHA512 ca97a1dbced3d9053ad9e94e444452a04f98f2a0afd1a91b4b3a0ac7d9414a73658224e08a83fcee7fc188b0ee17b231b309d37635a691c9fb232fa4f2ecca7e
SSDEEP 6144:ixZug0YMFmgIMqUtzO4W1Nydrh6EDvAJM/5:iomgIMqU5uMdfxR
TLSH
T1FD44128E71C08335E5E859BA50CD72C4A777F26C4E2CDAF64C7218331D693A2A468E5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6A1F.tmp

Path C:\ProgramData\4jHKrN5Hjh32\RCX6A1F.tmp
Size 267KB
SHA256 3a1c545d3aa4314401b269cfefbb4c7de01703f3d967ccb0188a8db20b9649c5
MD5 26dae91d08c0fb6c1bc1beed32528c9d
SHA1 95dd74e53afcf893561426930d6cf57a939df990
SHA512 77de39d4f2269d38ec6917b4cea48694ceea5f03d7f9bbaf11a37e0a67559da52796a732407deed7366100bf268b5de917090923f4e47f333e18df1b2896e6f6
SSDEEP 6144:ixZueJ7W8puCZ+Tk/ZhHrbTOJRDG/5m6oW+E:iVpuC3PHfiDG/5m6F+E
TLSH
T115442327E104C075D71B0FB50A4A2F84B5BE6E16097F9FF50DB1DE1BE6AA3B648C0858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/536-38-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1832-56-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1832-25-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2064-0-0x0000000000412000-0x0000000000413000-memory.dmp

Download

memory/2064-4-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/2644-1-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2644-2-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2644-17-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2644-3-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2644-5-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3812-58-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3812-39-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4176-59-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4176-52-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4260-20-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4260-27-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4296-51-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/4296-60-0x0000000000400000-0x000000000045E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads