134316ca7076b3460ba55c72701aeaa53a5544d84b26ecf3e5d410af7d5768aa

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
134316ca7076b3460ba55c72701aeaa53a5544d84b26ecf3e5d410af7d5768aa.exe
Size 428KB
Sample260916-ypeejsde38
SHA256 134316ca7076b3460ba55c72701aeaa53a5544d84b26ecf3e5d410af7d5768aa
MD5 e5c6ee962be44b8de7e43c30606367d0
SHA1 8b56cd7c8b09e559b6f68d047ee9bd4fc4d97110
SHA512 5694a83f08d1d9a3dcff8f498eb7830221cebb4073ebe03d386b97479db53287910f868e0db9d4f9c9d9127c93c674a7fe39feec765a1fe1da6ec748c9a72016
SSDEEP 12288:Z594+AcL4tBekiuKzErA61D6NNHz/+zufoLLdK/2KlLaH75Zal:BL4tBekiuVrAyD67H7Kzvw/tLaH75Za
TLSH
T1A794F1353281C037D2AA15344FF6CB69597EB9A60B2668C73BC41BBD5FA02E1D63434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4216	C762.tmp

Executes dropped EXE 1 IoCs

pid	Process
4216	C762.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	134316ca7076b3460ba55c72701aeaa53a5544d84b26ecf3e5d410af7d5768aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C762.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4216	4988	134316ca7076b3460ba55c72701aeaa53a5544d84b26ecf3e5d410af7d5768aa.exe	82

C:\Users\Admin\AppData\Local\Temp\134316ca7076b3460ba55c72701aeaa53a5544d84b26ecf3e5d410af7d5768aa.exe
"C:\Users\Admin\AppData\Local\Temp\134316ca7076b3460ba55c72701aeaa53a5544d84b26ecf3e5d410af7d5768aa.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\Temp\C762.tmp
  "C:\Users\Admin\AppData\Local\Temp\C762.tmp" --helpC:\Users\Admin\AppData\Local\Temp\134316ca7076b3460ba55c72701aeaa53a5544d84b26ecf3e5d410af7d5768aa.exe F955614E32FC3D4AF4A7B72157855F8D042AC8EDF52AF7CCBDD47438C4EB85152D1E0033743C71666FBD4CDFBF5DAE2BF4AAA30AECB819E0749D04A1E741AB7B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C762.tmp

Path C:\Users\Admin\AppData\Local\Temp\C762.tmp
Size 428KB
SHA256 17e3f5e1f4129ddbafd3542e242bb921815ec8e6f306e22aa13fcb257cb3d613
MD5 148c728ae62b8d8e120f47fcd17929b8
SHA1 56f6235b8963acc919b8f3f27379313525b49a77
SHA512 f570195403cc76d0484c07a15175c8bd77ad33051967f749bcdfd89fb9137c2622f685b53143b83213d44b21e277fa20b7c463bc556a207f633dc414b24ab70f
SSDEEP 12288:Z594+AcL4tBekiuKzErU+XR86QSH/RI80+oaCDZQgl:BL4tBekiuVrU+jRLOug
TLSH
T13394E0213591C033E29705388FF4C7AA697E79A60B2A64C77B80177D6F642D1E73538B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download