2f8eed8c470f4559fbc297deb8e542ffca56d4fc5e71bbf870614ba1a762eb58

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f8eed8c470f4559fbc297deb8e542ffca56d4fc5e71bbf870614ba1a762eb58.exe
Size 1.6MB
Sample261002-w77gyavfnd
SHA256 2f8eed8c470f4559fbc297deb8e542ffca56d4fc5e71bbf870614ba1a762eb58
MD5 171f47f6f5a3ecda79c1157879af01de
SHA1 b09424555355ee9f59e11353d53b4a06d194a415
SHA512 70e264dd9a1668b460f4f4aecb56d8327675b4fa8e75e11c0f3607d38ac3e04ae6d3fed740527971274ae5bb37b7b96291147c85f000636ff111dbf69beffc08
SSDEEP 24576:AJHPLxGSxZHRWx8Tu10A7ykw111HZ5EDSn9zoKyk+Jz0W3PwktqgHWvGNpPXZ4jM:Aialcpx761B72S9z9yNRX/zU8En0p
TLSH
T182751212B762C0F1C49702755962D33EFB7062004BA9CDE7EBC46D60AD626E67A3B34D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3172	1B0C0D0D120D156C155D15C0F0E160E0B160B.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4128	2f8eed8c470f4559fbc297deb8e542ffca56d4fc5e71bbf870614ba1a762eb58.exe
3172	1B0C0D0D120D156C155D15C0F0E160E0B160B.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f8eed8c470f4559fbc297deb8e542ffca56d4fc5e71bbf870614ba1a762eb58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1B0C0D0D120D156C155D15C0F0E160E0B160B.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 3172	4128	2f8eed8c470f4559fbc297deb8e542ffca56d4fc5e71bbf870614ba1a762eb58.exe	89

C:\Users\Admin\AppData\Local\Temp\2f8eed8c470f4559fbc297deb8e542ffca56d4fc5e71bbf870614ba1a762eb58.exe
"C:\Users\Admin\AppData\Local\Temp\2f8eed8c470f4559fbc297deb8e542ffca56d4fc5e71bbf870614ba1a762eb58.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\1B0C0D0D120D156C155D15C0F0E160E0B160B.exe
  C:\Users\Admin\AppData\Local\Temp\1B0C0D0D120D156C155D15C0F0E160E0B160B.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1B0C0D0D120D156C155D15C0F0E160E0B160B.exe

Path C:\Users\Admin\AppData\Local\Temp\1B0C0D0D120D156C155D15C0F0E160E0B160B.exe
Size 1.6MB
SHA256 61040b85739dda64c0bd2b29f8770ef4bffba9b2529e363f5176315489541b52
MD5 2e4e3c93fb705322a15b6286f2e64ddf
SHA1 dffd17c385e7b3984cc0598c57ac478b3170a258
SHA512 1a55c57c5b7cac7ae36db6d0c4aa8504cfa66381b116ce26bc55b9465220ea43861be70cd6e90a932ce3a5ce16ab82760812ad245bc6efb9977a14b08fcfce93
SSDEEP 24576:uJHPLxGSxZHRWx8Tu10A7ykw111HZ5EDSn9zoKyk+Jz0W3PwktqgHWvGNpPXZ4jM:uialcpx761B72S9z9yNRX/zU8En0p
TLSH
T1B3751212B762C0F1C49702755962D33EFB7062004BA9CDE7EBC46D60AD626E67A3B34D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3172-8-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/3172-10-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/3172-11-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/4128-0-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/4128-1-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/4128-9-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads