586815336dff734c728fdef3afef5defc3de7d65e90651c07ab30652521f2efd

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
586815336dff734c728fdef3afef5defc3de7d65e90651c07ab30652521f2efd.exe
Size 1.6MB
Sample260928-e6542svdja
SHA256 586815336dff734c728fdef3afef5defc3de7d65e90651c07ab30652521f2efd
MD5 49407e3924e6746a73751148e435c3d4
SHA1 88568237ebdc9eeff8c519eefef6323595068ecb
SHA512 77a5d09d570600136a39a2b3a217f551608e761962be5904ffe78560350ba1bc9bd1a9a417247ce12d3f4bd98a0e4392c0d0f8073064c54c0e46c2012f5e6c57
SSDEEP 24576:GJHPLxGSxZHRWx8Tu10A7ykw111HZ5EDSn9zoKyk+Jz0W3PwktqgHWvGNpPXZ4jM:Gialcpx761B72S9z9yNRX/zU8En0p
TLSH
T197751212B762C0F1C49702755962D33EFB7062004BA9CDE7EBC46D60AD626E67A3B34D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5068	1F0F0C0A120C156C155B15C0F0A160C0F160B.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5728	586815336dff734c728fdef3afef5defc3de7d65e90651c07ab30652521f2efd.exe
5068	1F0F0C0A120C156C155B15C0F0A160C0F160B.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	586815336dff734c728fdef3afef5defc3de7d65e90651c07ab30652521f2efd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1F0F0C0A120C156C155B15C0F0A160C0F160B.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5728 wrote to memory of 5068	5728	586815336dff734c728fdef3afef5defc3de7d65e90651c07ab30652521f2efd.exe	89

C:\Users\Admin\AppData\Local\Temp\586815336dff734c728fdef3afef5defc3de7d65e90651c07ab30652521f2efd.exe
"C:\Users\Admin\AppData\Local\Temp\586815336dff734c728fdef3afef5defc3de7d65e90651c07ab30652521f2efd.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Users\Admin\AppData\Local\Temp\1F0F0C0A120C156C155B15C0F0A160C0F160B.exe
  C:\Users\Admin\AppData\Local\Temp\1F0F0C0A120C156C155B15C0F0A160C0F160B.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:5068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1F0F0C0A120C156C155B15C0F0A160C0F160B.exe

Path C:\Users\Admin\AppData\Local\Temp\1F0F0C0A120C156C155B15C0F0A160C0F160B.exe
Size 1.6MB
SHA256 63a54a3668d8a8e7f7bf8939083a318763b038256d5a1a78a3798b0ded536b8b
MD5 ceb18113ef9f41646c6106b508c63bed
SHA1 7e5c0f95d337b960b542dd340e1f7b2650a46324
SHA512 ddf90b61589b8dad48e3ae73a62082499ce9717c8e33d126ff1af150411c3038bb0ee15a9e4c61ee3352e7d2356608b66c03593fcde36a6b024706af27cbca07
SSDEEP 24576:dJHPLxGSxZHRWx8Tu10A7ykw111HZ5EDSn9zoKyk+Jz0W3PwktqgHWvGNpPXZ4jM:dialcpx761B72S9z9yNRX/zU8En0p
TLSH
T194751212B762C0F1C49702755962D33EFB7062004BA9CDE7EBC46D60AD626E67A3B34D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5068-7-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/5068-11-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/5068-10-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/5728-0-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/5728-1-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/5728-8-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads