6fd23d8c9b561684bd260f493684472c0f0ee6eec26e7da72c4bd1634d88fdc4

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6fd23d8c9b561684bd260f493684472c0f0ee6eec26e7da72c4bd1634d88fdc4.exe
Size 4.7MB
Sample260916-mlvrksts8j
SHA256 6fd23d8c9b561684bd260f493684472c0f0ee6eec26e7da72c4bd1634d88fdc4
MD5 071b07e163c984f5e384ed3df367d2cc
SHA1 00abb910538c8b117bbee310613e44d4801e6736
SHA512 19e2c5e130d90a5f050ac65df66c2ae23580e8d776fd36c3402ad2c36977ad53aacd975671bc13af7b816967428f17994b3e2a37e6d61d6215bc1744a3cec0fc
SSDEEP 98304:PeBbo4gAb57++9gJf6PD3NmZ7AJEgLYXLKUCCCNYzQEr0WO0Yk84INUtD1+fm05i:54tx+VJiPD3NmlAJEgLYX5CNYzQEr0Wl
TLSH
T14236AE317DACA119D157E4F8B05FC3F8C9099A2043FD0ADD2134BE6056ABFA67344DAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1668	6fd23d8c9UWJT.exe

Executes dropped EXE 1 IoCs

pid	Process
1668	6fd23d8c9UWJT.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fd23d8c9b561684bd260f493684472c0f0ee6eec26e7da72c4bd1634d88fdc4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fd23d8c9UWJT.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1668	6fd23d8c9UWJT.exe
1668	6fd23d8c9UWJT.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1668	6fd23d8c9UWJT.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 1668	3448	6fd23d8c9b561684bd260f493684472c0f0ee6eec26e7da72c4bd1634d88fdc4.exe	85

C:\Users\Admin\AppData\Local\Temp\6fd23d8c9b561684bd260f493684472c0f0ee6eec26e7da72c4bd1634d88fdc4.exe
"C:\Users\Admin\AppData\Local\Temp\6fd23d8c9b561684bd260f493684472c0f0ee6eec26e7da72c4bd1634d88fdc4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\6fd23d8c9UWJT.exe
  -yue
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:1668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6fd23d8c9UWJT.exe

Path C:\Users\Admin\AppData\Local\Temp\6fd23d8c9UWJT.exe
Size 4.7MB
SHA256 53ddb1fdb84f27284d4a9336ad8d4d3ee06983bbc210853e8d52541ccbb3481f
MD5 d8ae815b591f36b99b046300af7ee27d
SHA1 8859ff0c83c8c7b3869660e1e1445938f616a917
SHA512 fafa14c90baed4bdefe41933cc6e6bb5f4c586c5287f854ed3d367839ddb123fd44266198a0fa4e50946d1ac52d12fe24b1df6434f3588086ac505c0dadfd296
SSDEEP 98304:VeBbo4gAb57++9gJf6PD3NmZ7AJEgLYXLKUCCCNYzQEr0WO0Yk84uNUtD1+fm05i:74tx+VJiPD3NmlAJEgLYX5CNYzQEr0W/
TLSH
T1E436AE317DACA119D157E4F8B05FC3F8C9099A2043FD0ADD2134BE6056ABFA67344DAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download