f325f34ffcff185b29ccb02e97aedd69c79b0d80a0d73973f37e79e0da3da302

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f325f34ffcff185b29ccb02e97aedd69c79b0d80a0d73973f37e79e0da3da302.exe
Size 1.6MB
Sample261011-m8jb3ahv21
SHA256 f325f34ffcff185b29ccb02e97aedd69c79b0d80a0d73973f37e79e0da3da302
MD5 667ada0a454de3b7d4a5fa0f049e9ad3
SHA1 0dc7d29783caae0406a337103b06bd89dccca761
SHA512 b3d312f42cd8373e359d821904111daf696b78f8179febf15499c08abcdec58e1b095911f305e7c670fe1ded75de6dc1c963821f1f1f2bdae92155d07519899e
SSDEEP 24576:bJHPLxGSxZHRWx8Tu10A7ykw111HZ5EDSn9zoKyk+Jz0W3PwktqgHWvGNpPXZ4jM:bialcpx761B72S9z9yNRX/zU8En0p
TLSH
T11A751212B762C0F1C49702755962D33EFB7062004BA9CDE7EBC46D60AD626E67A3B34D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4988	1E0E0C0A120D156A155C15C0E0F160E0B160A.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4168	f325f34ffcff185b29ccb02e97aedd69c79b0d80a0d73973f37e79e0da3da302.exe
4988	1E0E0C0A120D156A155C15C0E0F160E0B160A.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1E0E0C0A120D156A155C15C0E0F160E0B160A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f325f34ffcff185b29ccb02e97aedd69c79b0d80a0d73973f37e79e0da3da302.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4988	4168	f325f34ffcff185b29ccb02e97aedd69c79b0d80a0d73973f37e79e0da3da302.exe	89

C:\Users\Admin\AppData\Local\Temp\f325f34ffcff185b29ccb02e97aedd69c79b0d80a0d73973f37e79e0da3da302.exe
"C:\Users\Admin\AppData\Local\Temp\f325f34ffcff185b29ccb02e97aedd69c79b0d80a0d73973f37e79e0da3da302.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Users\Admin\AppData\Local\Temp\1E0E0C0A120D156A155C15C0E0F160E0B160A.exe
  C:\Users\Admin\AppData\Local\Temp\1E0E0C0A120D156A155C15C0E0F160E0B160A.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1E0E0C0A120D156A155C15C0E0F160E0B160A.exe

Path C:\Users\Admin\AppData\Local\Temp\1E0E0C0A120D156A155C15C0E0F160E0B160A.exe
Size 1.6MB
SHA256 5357146421bfa1fbb5ad708bc68b80005aacd224577604df7d2cf117fc032f43
MD5 1e93be410d4340fda4b032c5a981f364
SHA1 75c85a96ad75f3f93c4cb9ec6945cd2c164e5bba
SHA512 8c8e3015b0df7344d6b917ca0e25a34396f7b50a6efc160a8ce9771896624cfb32fd3a24e947f4c39062d947fc191923f7aec9de8554b88d3fd6afde18cf016a
SSDEEP 24576:lJHPLxGSxZHRWx8Tu10A7ykw111HZ5EDSn9zoKyk+Jz0W3PwktqgHWvGNpPXZ4jM:lialcpx761B72S9z9yNRX/zU8En0p
TLSH
T178751212B762C0F1C49702755962D33EFB7062004BA9CDE7EBC46D60AD626E67A3B34D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4168-0-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/4168-1-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/4168-9-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/4988-10-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/4988-11-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/4988-7-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads