70d50de9ac4e981d34d17c99fbae6c99509cbf60554b59ad9cd1b88ef09ab701

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70d50de9ac4e981d34d17c99fbae6c99509cbf60554b59ad9cd1b88ef09ab701.exe
Size 1.7MB
Sample260930-e64wzsswey
SHA256 70d50de9ac4e981d34d17c99fbae6c99509cbf60554b59ad9cd1b88ef09ab701
MD5 94f089a5e277818e49237da7f4076f1d
SHA1 02253adc6a32486c39b3f48a6b640629a96668c0
SHA512 c156ff5c5718a92af97215949e682399e0da92a4419f8b8eb8f44fdbc08b9c764639dd1958e7e0b4cbb996cca3e30508267b397b1d6de69bb88ddcaf5c309b99
SSDEEP 24576:9BdaBob0cPJuoAK62ZHdYA/XjpHiPIzHY9UyAPEsL4F2PJX3jpiSJ1xDqDPLMRz2:9ptPJ1A6HrpMIzHy9SxevMlnmBPyNQn
TLSH
T1A185125233F654B6F5F24A3A0D21A260593ABA518E51EC7F6294038F1C3DAA4DE70F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3396	70d50de9ac4e981d34d17c99fbae6c99509cbf60554b59ad9cd1b88ef09ab701.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	25	223.5.5.5	3396	70d50de9ac4e981d34d17c99fbae6c99509cbf60554b59ad9cd1b88ef09ab701.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\7za.exe	70d50de9ac4e981d34d17c99fbae6c99509cbf60554b59ad9cd1b88ef09ab701.exe
File created	C:\Windows\libwinnum.dll	70d50de9ac4e981d34d17c99fbae6c99509cbf60554b59ad9cd1b88ef09ab701.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70d50de9ac4e981d34d17c99fbae6c99509cbf60554b59ad9cd1b88ef09ab701.exe

C:\Users\Admin\AppData\Local\Temp\70d50de9ac4e981d34d17c99fbae6c99509cbf60554b59ad9cd1b88ef09ab701.exe
"C:\Users\Admin\AppData\Local\Temp\70d50de9ac4e981d34d17c99fbae6c99509cbf60554b59ad9cd1b88ef09ab701.exe"
1⤵
- Loads dropped DLL
- Unexpected DNS network traffic destination
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libwinnum.dll

Path C:\Windows\libwinnum.dll
Size 397KB
SHA256 5059e917c4cec4e63df74022d9cc36a154b5fbbc5cd7128dbfa6da60e046d232
MD5 8e6a7225bebce8491c178f9725d8ed38
SHA1 e868ae949cccf5770b625a702e85805b28762185
SHA512 b8df8a5e5729fe6f710a01fdb2744d673f87ffd6f8d19e833d0ad809c8295bc0b981b9adbbdecad87214a2c339a8e066ba38dcdb386253f19b71feccb531d80c
SSDEEP 6144:d/jYHgfhc+CvCitp+7fneay3qDlSezkX8K27OpWSi1cTKRMS5l20cZLcHVaM0Bt:9jYc1CvCid3qDc/SSmyS5l20qLc0M0Bt
TLSH
T16384D0A478F6AC9ADA41923D569B9337377E76E443538B434238B5726F43EC23AC4207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3396-1-0x0000000000EE0000-0x00000000012EC000-memory.dmp

Download

memory/3396-9-0x000000006ED80000-0x000000006EE9D000-memory.dmp