Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 05:14
Static task
static1
1 signatures
4 signatures
150 seconds
4 signatures
150 seconds
General
- Target [email protected]
- Size 136KB
- Sample260930-fxagfszbmd
- SHA256 0240d758044d786cd8036352cc23f407cd64c0bb4be44ab26432812f284a2a96
- MD5 2dc80fd1478c19a8d7be31233948f7f7
- SHA1 009b69b5a324de00de872b9e3433b26b75d8783d
- SHA512 f24537f2fb0c55c55302c5aa79abf4b8993568f00464150fb99a9eaeb0e4cc36444c29402c0e2e15d2ee9ebabf5a20b89d0071847f04c1962fd4b9dcab1423db
- SSDEEP 3072:8rDNlGM/wlmcj2fOYObL4DROvRNRz30D84Ax:OrGn2fF04DROvRfL3
- TLSH T119D36B0275E780B2C8AE487A146C4B566F7FA6148AF18B431F561ACFEF222D1DF35306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\fpfstb.dll [email protected] File opened for modification C:\Windows\SysWOW64\RCX6311.tmp [email protected] - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected] - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4232 [email protected] 4232 [email protected] - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4232 [email protected]
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232