0dcc12b943725c446a3f41c1092d0df4b39d293ea8f4b4392deaed718f7d73e0

Analysis

max time kernel
149s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0dcc12b943725c446a3f41c1092d0df4b39d293ea8f4b4392deaed718f7d73e0.exe
Size 468KB
Sample260916-xv663seq41
SHA256 0dcc12b943725c446a3f41c1092d0df4b39d293ea8f4b4392deaed718f7d73e0
MD5 cfc57424778f6f9e20c0e753047a187d
SHA1 b2663ffb21eded54ea225dfc20e1c01bae317829
SHA512 414e251486d3aa1bf40674dd009d234056e20a490d5f2437c19dfbcfbf0a8f097067035dce1493597e1e105e1c53105fee427847d979ef7271e7087544a03cc1
SSDEEP 12288:qO4rfItL8HGETJe1Jr6y66bxDgg6HpbfGBHgS/yOZA7bWmeEVGL:qO4rQtGGETJe1oyFVgg0bAHFGumeEVGL
TLSH
T154A4E0257241C133D29312714BE6EBAAA63F75B0036694D73BD8027D6F616E2D33A387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
868	9E8D.tmp

Executes dropped EXE 1 IoCs

pid	Process
868	9E8D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0dcc12b943725c446a3f41c1092d0df4b39d293ea8f4b4392deaed718f7d73e0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9E8D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 868	4812	0dcc12b943725c446a3f41c1092d0df4b39d293ea8f4b4392deaed718f7d73e0.exe	88

C:\Users\Admin\AppData\Local\Temp\0dcc12b943725c446a3f41c1092d0df4b39d293ea8f4b4392deaed718f7d73e0.exe
"C:\Users\Admin\AppData\Local\Temp\0dcc12b943725c446a3f41c1092d0df4b39d293ea8f4b4392deaed718f7d73e0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\9E8D.tmp
  "C:\Users\Admin\AppData\Local\Temp\9E8D.tmp" --helpC:\Users\Admin\AppData\Local\Temp\0dcc12b943725c446a3f41c1092d0df4b39d293ea8f4b4392deaed718f7d73e0.exe F4261FE80703106E5832B8348CD26977A9738F2CB37DC648AA01DC323FEF3AD6311738FB075616EB95EA48E34C15DFE0345F17E0B4BC037126C25342C95ED706
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9E8D.tmp

Path C:\Users\Admin\AppData\Local\Temp\9E8D.tmp
Size 468KB
SHA256 63874c161ce946306a5ef527ca0f7a86edbe9564e9910e2529fe033874c944f2
MD5 c61bb906ced30513999edb179f708106
SHA1 749d2da8822109b66d4132dacc31166f18f4a45b
SHA512 8afc4f35a85c16e9a53a11220195e27ee7db560b8c595a5598da9a2cb8c118768316eb0d01fcf53fd2123d8d3f3c0729d1085403f5a65fda05755e25a6212373
SSDEEP 12288:qO4rfItL8HG8McHegJrwiK9UOaYj/e7bWmeEVGL:qO4rQtGGlc+gJcDUGj/eumeEVGL
TLSH
T1CCA4F12A7241C133D29302751BEAEBAAA73E75B50725A4C33BD4063E2F656D1D33634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download