b55e4c82ae1c2e4fab506d5063a8381398e3bf7536e72df8702e04ed87c699aa

Analysis

max time kernel
2s
max time network
7s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Crypter By M4R7H V1.0.exe
Size 928KB
Sample260924-vpd71axcma
SHA256 b55e4c82ae1c2e4fab506d5063a8381398e3bf7536e72df8702e04ed87c699aa
MD5 a6ae1158e5e3588c9570004c460984ec
SHA1 b423dd7920e489a351fbb9d24d0deb3dcaf0505e
SHA512 756e8ed1f7da3cdfab64fc9a6a44098b4d9b6ea3f11522fb7a09a664efc5eb1c07e3c99a268a6f537ae1a1e3237d57780842efeee9d18bcf35dfc35442507f58
SSDEEP 12288:7WX68/Z5UDRMC7PigZZTZZ5UDRMC7PigZZT:7KdCmg7NdCmg7
TLSH
T1DB1539583664E89FC3421B385EE4FB6C652C1EE17D198701B9123BEE7E78F8E6D80152
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crypter By M4R7H V1.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1152	dw20.exe
Token: SeBackupPrivilege	1152	dw20.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 1152	484	Crypter By M4R7H V1.0.exe	89

C:\Users\Admin\AppData\Local\Temp\Crypter By M4R7H V1.0.exe
"C:\Users\Admin\AppData\Local\Temp\Crypter By M4R7H V1.0.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:484
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 1180
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/484-0-0x00000000012A0000-0x00000000012B0000-memory.dmp

Download

memory/484-1-0x00000000743B2000-0x00000000743B4000-memory.dmp