4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a.exe
Size 2.8MB
Sample260910-vskh7asgre
SHA256 4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a
MD5 afb00a929fcc12a442265edd37a00e4a
SHA1 01fd0551c529743a4d18ee94aa7eac8a33f08e7b
SHA512 421396202122471d0a5dd0c4c6a9da0da54ecb08bce23d772177ce74346f9b5b7b51793180148ac89ba06945c2d9040acbc5ce64c18f3d73dd807bfc9889b8da
SSDEEP 49152:qwRED8zmgeCntnUR4P/MGCpqp66dZ09YpLCfaO6bx+VWQ:qwRE4yg3tnURzGw79YpI61Y
TLSH
T1C3D5F113F2C7E03EE05E1B3305B2A05894F7AA616523BE56CAECB4ACCF751601D3E656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3424	4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a.tmp
1188	zWJ.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/1072-0-0x0000000000400000-0x00000000004CB000-memory.dmp	innosetup
behavioral1/memory/1072-20-0x0000000000400000-0x00000000004CB000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3424	4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a.tmp
3424	4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3424	4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 3424	1072	4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a.exe	85
PID 3424 wrote to memory of 1188	3424	4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a.tmp	86

C:\Users\Admin\AppData\Local\Temp\4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a.exe
"C:\Users\Admin\AppData\Local\Temp\4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Users\Admin\AppData\Local\Temp\is-JK5NN.tmp\4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JK5NN.tmp\4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a.tmp" /SL5="$A0054,2044202,776192,C:\Users\Admin\AppData\Local\Temp\4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Drivers\bV\zWJ.exe
    "C:\Drivers\bV\zWJ.exe" --console
    3⤵
    - Executes dropped EXE
    PID:1188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zWJ.exe

Path C:\Drivers\bV\zWJ.exe
Size 197KB
SHA256 91da76bb35c0ae1233ccc1443b64e6df7321224d8a322ecda39033d3ecf3a4ad
MD5 934dbf15b29a26d9f94a7badcca484f3
SHA1 89ea61cb38fdacccb3fdadfa62bd1d2599ea5db4
SHA512 3bdde0ec13f7a2dac3cbcf81f3d5f5e6960c040c5efcd2fc8d36743925a463baaf43e245b986e3303d86b707f5795b52ece713080859def75bd0698a7fa4d43d
SSDEEP 3072:Q0nLUc31EkRbH8xCBHbXWBCJ5atV2uO+uDiDVON6cKN:QaLU6Emb8+bPI2uO+uAQMX
TLSH
T193146D03F28530F5C1A68071E74BB322B776317503E0523A06ED99397ED6A9D9FBB294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-JK5NN.tmp\4cd42810d9c4076fd50550e929f438524b74356fd9db5ab6c52313092ab6ab1a.tmp
Size 3.0MB
SHA256 9c4b179a7bc0d375d4097dfd95ab3f7af640b97430d0af2fe9b7538771e61118
MD5 4c4e807b7312a4cf456f7bd67707ca96
SHA1 60fcf62180f685dd5f2c8abf4475a9f4dd1fe03d
SHA512 ac291e2aada2e4446c9af8741b21282050a5b8b511d84bdea0c445d081b09a01db5469aefbe29997224e05ae542c8f498962bba1057dea0d347b313cfb59a2ef
SSDEEP 49152:edJYVM+9JtzZWnoS2VC23aun8+f5KuGp+VYLC3Ntll6333T/:wJYVM+LtVt3P/KuGp+VYLC9V6333T
TLSH
T18DE55C17F389613ED05B2A352927C1515937BE707A2A8C575BEC3E4C8F361886E3B34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-0-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/1072-20-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/1188-22-0x00007FF60FA60000-0x00007FF60FA93000-memory.dmp

Download

memory/3424-5-0x0000000000D50000-0x0000000000D51000-memory.dmp

Download

memory/3424-19-0x0000000000400000-0x0000000000706000-memory.dmp

Download