41cc3738f2a6db1a5b8aa9cbee63c7493c2af174f379ed85c86f0392be7500c8

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
41cc3738f2a6db1a5b8aa9cbee63c7493c2af174f379ed85c86f0392be7500c8.exe
Size 443KB
Sample260910-spl7ha1fra
SHA256 41cc3738f2a6db1a5b8aa9cbee63c7493c2af174f379ed85c86f0392be7500c8
MD5 e28d0ed5a929431fac5c98d1911eebdc
SHA1 13fe6dd4988c3b5d13b33f34da08790d105cf264
SHA512 0b91625da9eacca2cb87fd8e258eec5fabb70f4bccb837b6fbab8fe0b9507572ff98f90c5ee63d5ca64aa8436f6214bdd40cb09564520dff080af92e842833f2
SSDEEP 12288:Wq4w/ekieZgU6NN7DmCFoHxkEuJonbtlMa:Wq4w/ekieH6DiCSHxcgbtP
TLSH
T195A4DF217586C037E1A706344AE9CAEA5A3A7DA04F71A4C73BD437AE6E745E0DB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4464	3E9A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4464	3E9A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41cc3738f2a6db1a5b8aa9cbee63c7493c2af174f379ed85c86f0392be7500c8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3E9A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 4464	4352	41cc3738f2a6db1a5b8aa9cbee63c7493c2af174f379ed85c86f0392be7500c8.exe	86

C:\Users\Admin\AppData\Local\Temp\41cc3738f2a6db1a5b8aa9cbee63c7493c2af174f379ed85c86f0392be7500c8.exe
"C:\Users\Admin\AppData\Local\Temp\41cc3738f2a6db1a5b8aa9cbee63c7493c2af174f379ed85c86f0392be7500c8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Users\Admin\AppData\Local\Temp\3E9A.tmp
  "C:\Users\Admin\AppData\Local\Temp\3E9A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\41cc3738f2a6db1a5b8aa9cbee63c7493c2af174f379ed85c86f0392be7500c8.exe FCA13FF6036FD23C1ECDB5DA921EAC73298A938724D08BFB92B2D6B6FD34115AF4D30DAA03B3D52F722C750E98F3CF985DB9E6599FBAEE0FDE8AB9EDFB2DE9BF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3E9A.tmp

Path C:\Users\Admin\AppData\Local\Temp\3E9A.tmp
Size 443KB
SHA256 570fd286da8271cfad2fc5cd446ae22a7ceb0686abe554e73ce514a3722d733a
MD5 9e3bc1b94891e3277be6a7f4a094f1c5
SHA1 b148e49b7c0ac39662668fda4702854e3e58d6ba
SHA512 871cc57cb31589edd6285f6092c889e4fe0b264eaad830c273d99cc188e10a3eb12aeb4dc95d98396e01c0afb38d6d5e267ac0111374592ef58e2a4e98fe4562
SSDEEP 12288:Wq4w/ekieZgU6pYhi91FgHaUQ3VMCJOxlMa:Wq4w/ekieH6pdV6aUQ32CJiP
TLSH
T10AA4DF217586C076E1A702348AE18BB9593A7DB04F76A4C73BD43BAE6E706D1DB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download