b01b0a69f72c53bae28a488133372672f10ff5aeb8c2ccc5c6905a20497c9528

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b01b0a69f72c53bae28a488133372672f10ff5aeb8c2ccc5c6905a20497c9528.exe
Size 306KB
Sample260929-prrm8a1wez
SHA256 b01b0a69f72c53bae28a488133372672f10ff5aeb8c2ccc5c6905a20497c9528
MD5 6e7be0f50503a66b0dafa9dc181cfd5d
SHA1 8d6030219e7c22d2721daa6cee455c76b4bed046
SHA512 8c42f3ff6b997494b787d3e09ebd338aca072fcc0d9e8dd955a7a8d82c129865bdd96dca2b1621964c737f8b1dec231b6a27134becb5170bae58bf4e2d61b61e
SSDEEP 6144:i9dbojriMlYDZTmbOKIWZZAtbJ41JHu/bWBZX5JbKapKT/q:CoVl2TmnvZAdJ41JHQ4/JbKF/q
TLSH
T18764BF02FEC158B2C6611D355A29BB21657DB9200F14DFDFA3E44A6DAA301C0BB35FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/files/0x000e00000001c50b-8.dat	Nirsoft

Executes dropped EXE 1 IoCs

pid	Process
2448	BatteryInfoView.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b01b0a69f72c53bae28a488133372672f10ff5aeb8c2ccc5c6905a20497c9528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BatteryInfoView.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2448	BatteryInfoView.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 2448	4140	b01b0a69f72c53bae28a488133372672f10ff5aeb8c2ccc5c6905a20497c9528.exe	88

C:\Users\Admin\AppData\Local\Temp\b01b0a69f72c53bae28a488133372672f10ff5aeb8c2ccc5c6905a20497c9528.exe
"C:\Users\Admin\AppData\Local\Temp\b01b0a69f72c53bae28a488133372672f10ff5aeb8c2ccc5c6905a20497c9528.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\BatteryInfoView.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BatteryInfoView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BatteryInfoView.cfg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BatteryInfoView.cfg
Size 706B
SHA256 4a0a65a90a1760bd73738b47956938ec8b0b1cbd804601251358cf0431df8c70
MD5 0030f5df001a410b94691c896b855c1e
SHA1 a43ac181ba6ca54afc4545f0e1f9e187209c804f
SHA512 661dd5cd7c8c2fc71c11ff85a2342ae722e8ee5deb2e0053d1d935f3da705cba8316885053498499e2d54e8706c1eb5c90aaa43f1cf2c2eee974ca0293b948d8
TLSH
T1B9012D02540B051CC0A2FFAD28A9355809F52D3BBDF48CF1679F2B18DED79062747040
MD5 SHA1 SHA512 TLSH

Submit Download

BatteryInfoView.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BatteryInfoView.exe
Size 78KB
SHA256 8dffb52b6826067ed8b56f549cbe53f4f5908e21582a54a9172ecfbad90afe37
MD5 be1b0c0cce1c61495e49b063f92d9d82
SHA1 df0981ca803ed0d176232a15827e54e0630078b3
SHA512 bd26d3a65039549dcf1d2373176f8e97155b6c3b1035fe4b52da1fc575beee7700fa44df62f5cdf8966010835116cbb54e1cb471c15ab3a6f5935cd245ad4f2f
SSDEEP 1536:PjkR3EeVVBS8gdigqdnynen2sgdaYZu9Gw1kbhR94k7NgribZINtotN6Sz7kxT5:LY0eVVBJgdiPny34N1k9n4k7NgribZIF
TLSH
T12D733A03B7E44075E4FB1A706A7756214BFAFC20A938CA1F9BA57A0E6CB4541CD12367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BatteryInfoView_lng.ini

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BatteryInfoView_lng.ini
Size 2KB
SHA256 de34022c6b1d8317d708ba45d5b0b17895b2fc3a776e7676b9cf2c675e8035fb
MD5 a7c7e32890d724980fd095f99ffa41fa
SHA1 4e55b88bc4bcd31c6fdb39508451c988e6263a65
SHA512 a5b88720b2719bf8ccb7787830056e57eea5fb785d25c3f4c94116073c07bd1b1f1b2e1120b1fe9b0bf37870adfbb4f98c1142316f1cd822049684f816d07604
TLSH
T174517421239250AE03D5DB3C632107A7B8537D746C3778D6B0656FAC79A0A9C6BC3B26
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads