82bbf2b2e3fcac80aebb17e42ba06f44ca8fd7021f894e5c20129923257fb821

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
82bbf2b2e3fcac80aebb17e42ba06f44ca8fd7021f894e5c20129923257fb821.exe
Size 9.0MB
Sample260916-2nssbs1v2r
SHA256 82bbf2b2e3fcac80aebb17e42ba06f44ca8fd7021f894e5c20129923257fb821
MD5 3eb9f6402dadb12fb1055332f5384093
SHA1 80aa07c8a34bb0f01117c237890a35248c31f0bd
SHA512 b68328d2586ba9105f8ba132d5d95371f6f6c5dc06fba38644bd6901abc27742522c439345e9e7795e846861db8383a0c725e4eac4e92512083ca684a2b68cdf
SSDEEP 196608:yrXlmdEIaVdqEIaVdpJVXry+U4DrjMrYnQCg:Ql9ZvHrBBfjKYnQCg
TLSH
T1A696E0C292E9429BD081C43D09A2DB397761DDA30623414FB25CF5EEBFFE6906B5126C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1708	82bbf2b2e3fcac80aebb17e42ba06f44ca8fd7021f894e5c20129923257fb821.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82bbf2b2e3fcac80aebb17e42ba06f44ca8fd7021f894e5c20129923257fb821.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1708	82bbf2b2e3fcac80aebb17e42ba06f44ca8fd7021f894e5c20129923257fb821.exe
1708	82bbf2b2e3fcac80aebb17e42ba06f44ca8fd7021f894e5c20129923257fb821.exe

C:\Users\Admin\AppData\Local\Temp\82bbf2b2e3fcac80aebb17e42ba06f44ca8fd7021f894e5c20129923257fb821.exe
"C:\Users\Admin\AppData\Local\Temp\82bbf2b2e3fcac80aebb17e42ba06f44ca8fd7021f894e5c20129923257fb821.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2EECore.2.8.15.dll

Path C:\Users\Admin\AppData\Local\Temp\E2EECore.2.8.15.dll
Size 10.1MB
SHA256 5ea3a1f359bdfd143c1df71430fb531af8430a0c33080d4907c135c35134b871
MD5 2fdd7abd6b8e3fd9ba425405d88d3340
SHA1 4291099d2a18b41a1b1e5fcc3c71bf256cc97ed2
SHA512 14f78ef5e272cc1b5e53aad8ab27fc66112adfc1dd40ef98a743ad8b052601a9b6006f5e0e77c4a652bc19a08cb6e8fb66275761619677635693378a3ea54805
SSDEEP 196608:A1iWdL1UhBE3We6Hus5zwQYki6T59st7t/9UjF0+KLU2z8VdG9qFLs:A1EBQWe6HZi6TS7t/9UjgtqFs
TLSH
T1D7B69E00FB438162D9CE057455AAA73A85387F2407396AD7F3583E6A6F316D23F3624E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download