c43c097ec0f5a259d9991e6c87cec0441e3dc9c20be31fa7ee3612b79a926546

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SYLTEditor.exe
Size 1.7MB
Sample260928-3e33dawbph
SHA256 c43c097ec0f5a259d9991e6c87cec0441e3dc9c20be31fa7ee3612b79a926546
MD5 d5a11e317d3e8c6ba41992375e6c1734
SHA1 c0c3e1e8a7150aa9cdbdd923e5014c8cdd0ee699
SHA512 0ea1a3617e0937cd174c1675594420f6d97a501dea5e6fccf927d09decba69df2d0aabd7cd726740cd4a7c78a3f7accba0b9a9d6511e8170c89d3ac5b96a2f32
SSDEEP 24576:AXGvdqPUb3mo3a6ax28EXLy7JOhxnwNejo9kTKdjg+6iiMIsTkEolXq:+sMUKKwwo9kOdjKJsTYlXq
TLSH
T1D8857DA47BDBC1F6EA4621B90C369B0D457E76924B385AE7B35C2D0E0B227D07C36316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SYLTEditor.exe
File opened (read-only)	\??\M:	SYLTEditor.exe
File opened (read-only)	\??\T:	SYLTEditor.exe
File opened (read-only)	\??\U:	SYLTEditor.exe
File opened (read-only)	\??\X:	SYLTEditor.exe
File opened (read-only)	\??\G:	SYLTEditor.exe
File opened (read-only)	\??\I:	SYLTEditor.exe
File opened (read-only)	\??\O:	SYLTEditor.exe
File opened (read-only)	\??\R:	SYLTEditor.exe
File opened (read-only)	\??\Y:	SYLTEditor.exe
File opened (read-only)	\??\A:	SYLTEditor.exe
File opened (read-only)	\??\E:	SYLTEditor.exe
File opened (read-only)	\??\H:	SYLTEditor.exe
File opened (read-only)	\??\K:	SYLTEditor.exe
File opened (read-only)	\??\P:	SYLTEditor.exe
File opened (read-only)	\??\Q:	SYLTEditor.exe
File opened (read-only)	\??\V:	SYLTEditor.exe
File opened (read-only)	\??\W:	SYLTEditor.exe
File opened (read-only)	\??\B:	SYLTEditor.exe
File opened (read-only)	\??\J:	SYLTEditor.exe
File opened (read-only)	\??\N:	SYLTEditor.exe
File opened (read-only)	\??\S:	SYLTEditor.exe
File opened (read-only)	\??\Z:	SYLTEditor.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SYLTEditor.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4724	SYLTEditor.exe
Token: SeCreatePagefilePrivilege	4724	SYLTEditor.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4724	SYLTEditor.exe
4724	SYLTEditor.exe

C:\Users\Admin\AppData\Local\Temp\SYLTEditor.exe
"C:\Users\Admin\AppData\Local\Temp\SYLTEditor.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download