19c8893ed70f482f60ffed55a6444aec655c4765e83cc6042ca0775bad1c17ee

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
19c8893ed70f482f60ffed55a6444aec655c4765e83cc6042ca0775bad1c17ee.exe
Size 123KB
Sample260916-mdck2aak31
SHA256 19c8893ed70f482f60ffed55a6444aec655c4765e83cc6042ca0775bad1c17ee
MD5 de68da59ab08c78fab0ae2500e2b3a1e
SHA1 cc8a0637677ffe66561bbfc8c8db37433de000ee
SHA512 b57692dc19c7bdcb4c4af99e2a5af5ad742c0651a770a4857a10526eba5057b6d17a03078392ef5dc4b0ba0020de461c22d12c2e7dc4f732ccb44553fd685e74
SSDEEP 3072:S7edtTo17TZtDh/vVy5qy78qqykD3WfnGsc+:SYt0pDh/v0zkD0nG
TLSH
T1A8C3D711EFCAD866FDA126785CB3C2B90379FC209AD2CA4B57C45D5F7E6061188E1F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	19c8893ed70f482f60ffed55a6444aec655c4765e83cc6042ca0775bad1c17ee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	19c8893ed70f482f60ffed55a6444aec655c4765e83cc6042ca0775bad1c17ee.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6016	19c8893ed70f482f60ffed55a6444aec655c4765e83cc6042ca0775bad1c17ee.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5216	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5216	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\19c8893ed70f482f60ffed55a6444aec655c4765e83cc6042ca0775bad1c17ee.exe
"C:\Users\Admin\AppData\Local\Temp\19c8893ed70f482f60ffed55a6444aec655c4765e83cc6042ca0775bad1c17ee.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:6016

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6016-0-0x0000000000409000-0x000000000040A000-memory.dmp

Download

memory/6016-1-0x0000000000400000-0x0000000000425000-memory.dmp