Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 09:20
General
- Target ad32cad9cfc8c820e5c91d750796ed93f573f2335fc2dd87692e28dfc28626e5.exe
- Size 1.4MB
- Sample261002-laxalawsbw
- SHA256 ad32cad9cfc8c820e5c91d750796ed93f573f2335fc2dd87692e28dfc28626e5
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad32cad9cfc8c820e5c91d750796ed93f573f2335fc2dd87692e28dfc28626e5.exe"C:\Users\Admin\AppData\Local\Temp\ad32cad9cfc8c820e5c91d750796ed93f573f2335fc2dd87692e28dfc28626e5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\.reservas-installer-f75f3888661c4cb48298c98475f6553f\InstallTransaction.exe"C:\Users\Admin\AppData\Local\Temp\.reservas-installer-f75f3888661c4cb48298c98475f6553f\InstallTransaction.exe" "validate" "C:\Users\Admin\AppData\Local\Programs\ReservasAmigosLocal-x86" "C:\Users\Admin\AppData\Local\Programs\ReservasAmigosLocal-x86\.stage-1.4.0.0-f75f3888661c4cb48298c98475f6553f" "1.4.0.0" "x86" "false" "C:\Users\Admin\AppData\Local\Temp\.reservas-installer-f75f3888661c4cb48298c98475f6553f\result.txt"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\.reservas-installer-f75f3888661c4cb48298c98475f6553f\InstallTransaction.exe"C:\Users\Admin\AppData\Local\Temp\.reservas-installer-f75f3888661c4cb48298c98475f6553f\InstallTransaction.exe" "install" "C:\Users\Admin\AppData\Local\Programs\ReservasAmigosLocal-x86" "C:\Users\Admin\AppData\Local\Programs\ReservasAmigosLocal-x86\.stage-1.4.0.0-f75f3888661c4cb48298c98475f6553f" "1.4.0.0" "x86" "false" "C:\Users\Admin\AppData\Local\Temp\.reservas-installer-f75f3888661c4cb48298c98475f6553f\result.txt"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
LEEME.txt
ReservasAmigos.exe
ReservasAmigos.exe.config
SHA256.json
SQLITE-PROVENANCE.json
catalog.json
sqlite3.dll
InstallTransaction.exe
result.txt
memory/2068-26-0x00000000745C0000-0x0000000074D7C000-memory.dmp
memory/2068-35-0x00000000745C0000-0x0000000074D7C000-memory.dmp
memory/3208-15-0x00000000745C0000-0x0000000074D7C000-memory.dmp
memory/3208-14-0x00000000745C0000-0x0000000074D7C000-memory.dmp
memory/3208-12-0x0000000000A30000-0x0000000000A3A000-memory.dmp
memory/4844-0-0x00000000745D2000-0x00000000745D3000-memory.dmp
memory/4844-16-0x000000000B3C0000-0x000000000B3D2000-memory.dmp
memory/4844-5-0x00000000745C0000-0x0000000074D7C000-memory.dmp
memory/4844-4-0x00000000059E0000-0x00000000059EA000-memory.dmp
memory/4844-3-0x0000000005880000-0x0000000005912000-memory.dmp
memory/4844-2-0x0000000005DA0000-0x000000000635A000-memory.dmp
memory/4844-1-0x0000000000D30000-0x0000000000E94000-memory.dmp
memory/4844-10-0x00000000745D2000-0x00000000745D3000-memory.dmp
memory/4844-37-0x00000000745C0000-0x0000000074D7C000-memory.dmp
memory/4844-38-0x00000000745C0000-0x0000000074D7C000-memory.dmp