898205bb862039e41b84bd1a5590416095174d87e5c6c38b7f41d0b134d0ff03

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
898205bb862039e41b84bd1a5590416095174d87e5c6c38b7f41d0b134d0ff03.exe
Size 3.7MB
Sample260929-s2nabsvbld
SHA256 898205bb862039e41b84bd1a5590416095174d87e5c6c38b7f41d0b134d0ff03
MD5 8f7b295fc609752520e172e26dcdbb8c
SHA1 61e2bef8c5b956b0e0632b11a66a72fe4763a191
SHA512 23fc16ea5b3a69994ce79f7c76e5054b23b92c1a25c7812480001dfd31b6e17900a2fdf91dc3743a01d79fd42b874ae05bfe3dfdec65dcd3840e527fc7b12bc3
SSDEEP 98304:NC0Uq/np6a7MwvXlUvUF4GGFo6/NEY8kWi3HoGg:Iq/nAoV4MGSyH8ti3pg
TLSH
T13A06E102FBC281B1E5930174556BB77F8D79BA34672489C7ABC01D2D8C316D16A3A3AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1596-0-0x0000000000400000-0x00000000007C4000-memory.dmp	upx
behavioral2/memory/1596-2-0x0000000000400000-0x00000000007C4000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1816	1596	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	898205bb862039e41b84bd1a5590416095174d87e5c6c38b7f41d0b134d0ff03.exe

C:\Users\Admin\AppData\Local\Temp\898205bb862039e41b84bd1a5590416095174d87e5c6c38b7f41d0b134d0ff03.exe
"C:\Users\Admin\AppData\Local\Temp\898205bb862039e41b84bd1a5590416095174d87e5c6c38b7f41d0b134d0ff03.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 588
  2⤵
  - Program crash
  PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1596 -ip 1596
1⤵
PID:5228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1596-0-0x0000000000400000-0x00000000007C4000-memory.dmp

Download

memory/1596-1-0x00000000005C4000-0x00000000005C5000-memory.dmp

Download

memory/1596-2-0x0000000000400000-0x00000000007C4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads