70b745251b2fd7baeab4981538716c052a6b115de5c907d77d784914b29f8deb

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70b745251b2fd7baeab4981538716c052a6b115de5c907d77d784914b29f8deb.exe
Size 1.6MB
Sample260919-thygmaha52
SHA256 70b745251b2fd7baeab4981538716c052a6b115de5c907d77d784914b29f8deb
MD5 de44f87584cfba6a03660cec523cfab5
SHA1 31fe7d9697682487c66b8ac2609134da80d6b5be
SHA512 c3cdea0c68f457351d25345fc26a71cdb35359dca60757b4ab53e55d368b621d773a306c5053e0e5e1756cad5b8c42b854f212a79aa3278a044df821af9dcd8c
SSDEEP 24576:8M5LPdrM0/TbxwxcbTKNHbNbfDUEdprvSgQ1SwkPJ3nd9n86HLJJ:8OrtxwynKdxbfDhdprlQk3J/8wLJJ
TLSH
T1ED758C22B6A590F2C606407648A69B3AF772B6990F34D7C79390CB3A4E733D09D3E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4600	2Box_x64_helper.dll

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70b745251b2fd7baeab4981538716c052a6b115de5c907d77d784914b29f8deb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4008	70b745251b2fd7baeab4981538716c052a6b115de5c907d77d784914b29f8deb.exe
4008	70b745251b2fd7baeab4981538716c052a6b115de5c907d77d784914b29f8deb.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 4600	4008	70b745251b2fd7baeab4981538716c052a6b115de5c907d77d784914b29f8deb.exe	85

C:\Users\Admin\AppData\Local\Temp\70b745251b2fd7baeab4981538716c052a6b115de5c907d77d784914b29f8deb.exe
"C:\Users\Admin\AppData\Local\Temp\70b745251b2fd7baeab4981538716c052a6b115de5c907d77d784914b29f8deb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Users\Admin\AppData\Local\Temp\2Box_x64_helper.dll
  C:\Users\Admin\AppData\Local\Temp\2Box_x64_helper.dll
  2⤵
  - Executes dropped EXE
  PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2Box_x64_helper.dll

Path C:\Users\Admin\AppData\Local\Temp\2Box_x64_helper.dll
Size 159KB
SHA256 9ababeacac0da9c8e46a9d79cda3741373b0b8db7b3e89771860accd710c58ff
MD5 a02ee26dcabab4770481addc0b25d37a
SHA1 6faa3c73b2ea71cb1bec97fe5e2a9dbbe3b20c46
SHA512 849ca015507bd18e5af54d0a8865ca77288f0c0ea4fec311a248c7385b343f637a111b6e0d0e5cafacbdce7a0225b4b887cbe34337b624e09cae39a73dcdd3d3
SSDEEP 3072:SeFt6lK8V+w/F+2F+GXFVPqTxWtMUK/EYIfFoUbk7tTt5Jv5Eamd1:mKIn3O4YIfF1hF
TLSH
T19DF3E72B7668A0F2D155817EC9829B49F77275A11F2297CF1321877E0F336E29D3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download