2fb402c16ee5ba98209805f42ffa212c7991558c3573226bf7a05e492f0d4c46

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2fb402c16ee5ba98209805f42ffa212c7991558c3573226bf7a05e492f0d4c46.exe
Size 4.7MB
Sample261003-pryrjaydpe
SHA256 2fb402c16ee5ba98209805f42ffa212c7991558c3573226bf7a05e492f0d4c46
MD5 4a700ed9a18b853d92317a4af1906b2f
SHA1 9d878138574b41fbddf54700fc0ea06023d28891
SHA512 6fbaddadee1291ab67b343f6bd395f1d0a2795234b9a6a3f2460b46db08914d6028329421eee8a7f49c3c2095bcf55f18dd2e7120787b213846a9fd4ed6b4383
SSDEEP 98304:Byu+fMpJffTiP4lmE38fXrmE38fXm1u7sPRy:BL2QmE38fbmE38fWrRy
TLSH
T181367D126613C826D21227B491B1E338DA785FA02D398E83EFF0BC677F726975B511C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4264	2fb402c16ee5ba98209805f42ffa212c7991558c3573226bf7a05e492f0d4c46.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	2fb402c16ee5ba98209805f42ffa212c7991558c3573226bf7a05e492f0d4c46.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2fb402c16ee5ba98209805f42ffa212c7991558c3573226bf7a05e492f0d4c46.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4264	2fb402c16ee5ba98209805f42ffa212c7991558c3573226bf7a05e492f0d4c46.exe
4264	2fb402c16ee5ba98209805f42ffa212c7991558c3573226bf7a05e492f0d4c46.exe

C:\Users\Admin\AppData\Local\Temp\2fb402c16ee5ba98209805f42ffa212c7991558c3573226bf7a05e492f0d4c46.exe
"C:\Users\Admin\AppData\Local\Temp\2fb402c16ee5ba98209805f42ffa212c7991558c3573226bf7a05e492f0d4c46.exe"
1⤵
- Loads dropped DLL
- Direct Volume Access: Opens a physical disk for reading
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zrTcp.dll

Path C:\Users\Admin\AppData\Roaming\zrTcp.dll
Size 427KB
SHA256 f17068d4b82305bfe0aa80a6771057b01d26759c4cb3ebf86f6c6cebdfcfdc4c
MD5 a838589d103c21ee4855cabe3c617dd6
SHA1 db3a91481df0904388bb95ec10af0a56cdf7f3bb
SHA512 9d5ccde82b7c94e591dfcebbdd76ff347d930820c017d516f4ecf4ddc8fcd9d09cc098e43896e0f28fa8c8975b69baae0371fe2d23ab46d6eea77a70d620f8c5
SSDEEP 12288:xUykXx7V0n6EBrUf2m5jqNuIeQ2ndoBq7sMF2WAF:79TeQ87sk2R
TLSH
T18E947C207586C136C89D0131A978DBAF952DA9A44F7805DBE3D82F7F1F246C21F31AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download