5b3776ad6cae0fc067ca7ad54828d4ed71165515c64a266bf5711bd000baae3f

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b3776ad6cae0fc067ca7ad54828d4ed71165515c64a266bf5711bd000baae3f.exe
Size 449KB
Sample260925-hyd75ssdkg
SHA256 5b3776ad6cae0fc067ca7ad54828d4ed71165515c64a266bf5711bd000baae3f
MD5 51dceee4dd170f068b1b4bf747f0f30b
SHA1 07509096b6a51cdb0ae674d680b456bdb1e9ca78
SHA512 7e842930c70d10fcc14cddaaea6821f93f63416cf6e5d5121c1d0fd21ad43b718c8874e3897916bd565cccc2199cb78edee29e7095b7e4d6ab5a0856ee565942
SSDEEP 6144:NwxXYNt45SvibADn0ofR7JxNwqdfNqWVqQfIcbXr1VJCIA6srTZbRO:NwxCL0QJTEWVqQfISxVJCIApO
TLSH
T1C7A43A027790D036D16235764E97DEB566AABD235E23534B7BD07F3FBE301918A2830A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5108	5b3776ad6cae0fc067ca7ad54828d4ed71165515c64a266bf5711bd000baae3f.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b3776ad6cae0fc067ca7ad54828d4ed71165515c64a266bf5711bd000baae3f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b3776ad6cae0fc067ca7ad54828d4ed71165515c64a266bf5711bd000baae3f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5108	5b3776ad6cae0fc067ca7ad54828d4ed71165515c64a266bf5711bd000baae3f.exe
5108	5b3776ad6cae0fc067ca7ad54828d4ed71165515c64a266bf5711bd000baae3f.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 5108	2520	5b3776ad6cae0fc067ca7ad54828d4ed71165515c64a266bf5711bd000baae3f.exe	89

C:\Users\Admin\AppData\Local\Temp\5b3776ad6cae0fc067ca7ad54828d4ed71165515c64a266bf5711bd000baae3f.exe
"C:\Users\Admin\AppData\Local\Temp\5b3776ad6cae0fc067ca7ad54828d4ed71165515c64a266bf5711bd000baae3f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\5b3776ad6cae0fc067ca7ad54828d4ed71165515c64a266bf5711bd000baae3f.exe
  "C:\Users\Admin\AppData\Local\Temp\5b3776ad6cae0fc067ca7ad54828d4ed71165515c64a266bf5711bd000baae3f.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e5a6e7a.tmp

Path C:\Users\Admin\AppData\Local\Temp\0e5a6e7a.tmp
Size 5.2MB
SHA256 ab0f8f629d67fb88528a8db4485d1bd8a7f221ed788922cba961e82d798c3737
MD5 eaaafb91f3b6a7883bbc43e27194e000
SHA1 da6ed1d8f2aa2032f7921d1a283b8a28b148804a
SHA512 699c2d877da14fedcce6b91b6902c7c4e0bae8587dc896f418541d391f9c8b5c760d1417fd4c100910f506bb576f2a84c45e1e44a99677c7a384133f12add242
SSDEEP 49152:xwfZ2dAJyFZrb/TWvO90d7HjmAFd4A64nsfJVUkNCxKmKMF9C4S4PgasvccmnkL:AJyuA4Ekad0sD7oO1fncqugU
TLSH
T198468C07BC9550E8C6EED230897A4252B7717C881B3177D32B60B6B92E73BD85E39394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b3776ad6cae0fc067ca7ad54828d4ed71165515c64a266bf5711bd000baae3f.exe

Path C:\Users\Admin\AppData\Local\Temp\5b3776ad6cae0fc067ca7ad54828d4ed71165515c64a266bf5711bd000baae3f.exe
Size 353KB
SHA256 98dc2c1e340c6da6a9ff619f368e9b27b12a2853cd06b229fc0739837c538cf6
MD5 be89e1c81ae44f01b77c1c1be9486faa
SHA1 cb317468b340a8c6eada7e9d16079c3aa9ac5b31
SHA512 9eeda0cf6e7b968c7bf8cd33d02388e69d47610cc44cd51a955baf743ef89f9f52ee7f8737b23694678e11c7113bc8e70fd121e0c7e1516267a27fb38a59b657
SSDEEP 6144:7xXYNt45SvibADn0ofR7JxNwqdfNqWVqQfIcbXr1VJCIA6srTZbRO:7xCL0QJTEWVqQfISxVJCIApO
TLSH
T12A743A127790C436C26235764A57DEB5A6AEBD235E2353477BD03F3FBE301919A2830A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX6F56.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX6F56.tmp
Size 96KB
SHA256 c06aa0a898d1b367073d926f22fb2ea37f109c7ee5adaa8c19f35ec2d0d8d7d0
MD5 a69d780c2bd1e11dbc508d850bb3f668
SHA1 54edd625e906e40837f7d433aa4cff259bd88f8c
SHA512 9af6a6041e98cfecfb5ee548dabafbb4db9171c5b43c6059d73b143a3cdf4200f810aeedabf689630118cf0c9084264ae78ccd883832ac74b10f5e88d0eebb56
SSDEEP 384:Wu9xD0sO20SeBcV5fxZ2/AGbzx4fbIot3qnd9ZOxaefMlN+DW6QM72VlLkKmX:WuLv0SpxeAidabHtydtZlNo0Y2VFTI
TLSH
T114A3B58DA9C6F156E02049BE2FF6DEA547667C272743732FA7C0BD1B7B715810D46202
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads