61144c3b91051ce303cd68365b74023c411a3da00518a0513163350520b18f61

Analysis

max time kernel
148s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
61144c3b91051ce303cd68365b74023c411a3da00518a0513163350520b18f61.exe
Size 1.2MB
Sample260916-mlnchaae75
SHA256 61144c3b91051ce303cd68365b74023c411a3da00518a0513163350520b18f61
MD5 5eac69c415251923372f61decd97c568
SHA1 61211bf8c1e18287e71cc4fe228acc666888332b
SHA512 254893c3bb428881e32bfed8acffaa2c5ddc9595e8586e2a4726f812dfee4c620dd977e7e913b6bce68c5ca3ff36549133fd9a443c93cfe9463a1a3d839db6cd
SSDEEP 24576:uqYJmyOHv+MYsl9Pmbv72Hx0xQ/lII6m1xw5a0/YL:bYJEP+sHPmbv72ROQ/l6mnw5a0wL
TLSH
T19945491133E5813AF6B207306D7CA7A4567ABC721F3285CF63986A5D1A30AD19B31B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	61144c3b91051ce303cd68365b74023c411a3da00518a0513163350520b18f61.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	61144c3b91051ce303cd68365b74023c411a3da00518a0513163350520b18f61.exe

C:\Users\Admin\AppData\Local\Temp\61144c3b91051ce303cd68365b74023c411a3da00518a0513163350520b18f61.exe
"C:\Users\Admin\AppData\Local\Temp\61144c3b91051ce303cd68365b74023c411a3da00518a0513163350520b18f61.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:4076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4076-0-0x0000000000CE0000-0x0000000000E1D000-memory.dmp

Download