52b65693427033b003bba52a10dd9b7223d06acfc41dbe52f5d408e69a521a0d

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dobrota.exe
Size 14.4MB
Sample260930-x4d7nasalf
SHA256 52b65693427033b003bba52a10dd9b7223d06acfc41dbe52f5d408e69a521a0d
MD5 284319d621e8f3922b4b98b7096d40ce
SHA1 0b1a72436ee43d769c4a36085336190077380dee
SHA512 481f7c5728c6155ce4e57f4935492597ca263103eda58781bba00b7a8dfb067aace6dc1faac4e520c58e92ca5d73d04aec88d59102be7db5386efc4129ad223b
SSDEEP 196608:1Q9J32KR45ZVE8lj8NsFWCNffyA5EAK4Yniwm5nD1PJlJ32KRDS8:6fhcjVFWonyA2AKhni11PthI8
TLSH
T14DE6CF11FA876DB2EC8667F020C3733A6338EE20C769DA37B944FD2496736C4652A745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4496	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dobrota.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4496	4848	dobrota.exe	91

C:\Users\Admin\AppData\Local\Temp\dobrota.exe
"C:\Users\Admin\AppData\Local\Temp\dobrota.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E0F5.tmp\E0F6.bat C:\Users\Admin\AppData\Local\Temp\dobrota.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E0F6.bat

Path C:\Users\Admin\AppData\Local\Temp\E0F5.tmp\E0F6.bat
Size 478B
SHA256 a95e5a0d4a01ed7af1208a321b86915fde0fea6231394e037adc10fb85d0e546
MD5 4aa8ea9059749db0b0cb7ec0636c89e8
SHA1 34d383a6ee1d3f349616addd136e2dbe0a2eec1b
SHA512 b959a59d38a2a0d32043c5811d85a3eed633a78e449851f7777c102f5fcacfa9c0254d93d75c36886d8787aeb7723060252d99e7c48bb2f16f15b0a62418764c
TLSH
T131F0550DFC0B0C0A8E90CC9737A03B8FE15A722E1BE2A44CB4025029897FE8E3608F00
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4848-0-0x0000000000412000-0x0000000000413000-memory.dmp

Download

memory/4848-29-0x0000000000412000-0x0000000000413000-memory.dmp