b7fdc816ed94247511492240afaaffdab5fdcc1fa4b5c47ddf1a62f6223834be

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b7fdc816ed94247511492240afaaffdab5fdcc1fa4b5c47ddf1a62f6223834be.exe
Size 966KB
Sample260925-t6thks1dnf
SHA256 b7fdc816ed94247511492240afaaffdab5fdcc1fa4b5c47ddf1a62f6223834be
MD5 c725892089ec1078e0e64c82b57aa9e5
SHA1 d10d1c050ec05a2a71ce44addccd871258859791
SHA512 4ad0547a2c038f8e917f99e1c92cba918f0c6699a663d8ab2557cd2b5d9bc78ba45363066276a3baf329efca34bb8064aaa7c17a1031eb4102a652b519cc443a
SSDEEP 12288:WeT47NrTfGODvVOe2zUfIBCSqi2zdlA/cYHiJ1hkdgsswM/C02ApwPgmRVf2D/Yy:5OrT+w3MqnSEvA0wmCt18FsSkjA4
TLSH
T1E725233A62C8CBB4DE90D83E44047AFF608DF45480A656E9D57FFB42783CA75479A823
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4872-0-0x0000000000600000-0x0000000000C09000-memory.dmp	upx
behavioral2/memory/4872-2-0x0000000000600000-0x0000000000C09000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b7fdc816ed94247511492240afaaffdab5fdcc1fa4b5c47ddf1a62f6223834be.exe

C:\Users\Admin\AppData\Local\Temp\b7fdc816ed94247511492240afaaffdab5fdcc1fa4b5c47ddf1a62f6223834be.exe
"C:\Users\Admin\AppData\Local\Temp\b7fdc816ed94247511492240afaaffdab5fdcc1fa4b5c47ddf1a62f6223834be.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4872-0-0x0000000000600000-0x0000000000C09000-memory.dmp

Download

memory/4872-2-0x0000000000600000-0x0000000000C09000-memory.dmp