30ec23583bb0591c738a8a71540553f870a2d33d9ce6a7cde27652cb622bc896

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
30ec23583bb0591c738a8a71540553f870a2d33d9ce6a7cde27652cb622bc896.exe
Size 1.6MB
Sample261002-prryzsaa57
SHA256 30ec23583bb0591c738a8a71540553f870a2d33d9ce6a7cde27652cb622bc896
MD5 f20fe526c835228b3545b7220ce3ea5c
SHA1 6c8718fc6b23409fa54e2aac7af74d3f4b30c39f
SHA512 41d1b3ca026a1d68c004c5eacf7e694ee6c8ae52e59cd39321b36396fbbd22eef5e0276a676f31c16f49cd8eba28be418b5883b898674ebe5bd76892910dc520
SSDEEP 24576:EJHPLxGSxZHRWx8Tu10A7ykw111HZ5EDSn9zoKyk+Jz0W3PwktqgHWvGNpPXZ4jM:Eialcpx761B72S9z9yNRX/zU8En0p
TLSH
T1C6751212B762C0F1C49702755962D33EFB7062004BA9CDE7EBC46D60AD626E67A3B34D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5268	1F0A0C0F120F156A155B15C0D0B160D0B160D.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4168	30ec23583bb0591c738a8a71540553f870a2d33d9ce6a7cde27652cb622bc896.exe
5268	1F0A0C0F120F156A155B15C0D0B160D0B160D.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30ec23583bb0591c738a8a71540553f870a2d33d9ce6a7cde27652cb622bc896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1F0A0C0F120F156A155B15C0D0B160D0B160D.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 5268	4168	30ec23583bb0591c738a8a71540553f870a2d33d9ce6a7cde27652cb622bc896.exe	88

C:\Users\Admin\AppData\Local\Temp\30ec23583bb0591c738a8a71540553f870a2d33d9ce6a7cde27652cb622bc896.exe
"C:\Users\Admin\AppData\Local\Temp\30ec23583bb0591c738a8a71540553f870a2d33d9ce6a7cde27652cb622bc896.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Users\Admin\AppData\Local\Temp\1F0A0C0F120F156A155B15C0D0B160D0B160D.exe
  C:\Users\Admin\AppData\Local\Temp\1F0A0C0F120F156A155B15C0D0B160D0B160D.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:5268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1F0A0C0F120F156A155B15C0D0B160D0B160D.exe

Path C:\Users\Admin\AppData\Local\Temp\1F0A0C0F120F156A155B15C0D0B160D0B160D.exe
Size 1.6MB
SHA256 068ad57b3b94e6f6c3f2c970287b6b34b87bf5338dff57d0102f6407fedae340
MD5 6f18e471b5d82b274c521cb65d2f1259
SHA1 84f8f9d61abcc44db48162d0cd1a39749f8f2264
SHA512 6cae74a6e7008c52d3db32091099229336a3cbf059aa10e2c3d31e19953815f1c1e2eed3fa60d8e850afc0b33e331f304d0f5d5fc292d6957b488c0a1ffae6d5
SSDEEP 24576:YJHPLxGSxZHRWx8Tu10A7ykw111HZ5EDSn9zoKyk+Jz0W3PwktqgHWvGNpPXZ4jM:Yialcpx761B72S9z9yNRX/zU8En0p
TLSH
T179751212B762C0F1C49702755962D33EFB7062004BA9CDE7EBC46D60AD626E67A3B34D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4168-0-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/4168-1-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/4168-9-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/5268-10-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/5268-11-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/5268-8-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads