74a6543f8ce9e1c77fbe2a8eee925b7170e2c58b3d002ceac5c42687f2bf657f

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74a6543f8ce9e1c77fbe2a8eee925b7170e2c58b3d002ceac5c42687f2bf657f.exe
Size 1.6MB
Sample261011-p8fbhsab44
SHA256 74a6543f8ce9e1c77fbe2a8eee925b7170e2c58b3d002ceac5c42687f2bf657f
MD5 c387cac67165c87a52b0ac2e7707eff0
SHA1 c41593581e9566653a0e05ea03ff549b678175e4
SHA512 d024fcdbd9f8b5014ce7070adb5f7c755d4a43d1d147cfa4c78ebaab329913c37640cb1518968d262e453119daef8a876e87e909a443719d7322ab17fac6b1f2
SSDEEP 24576:NJHPLxGSxZHRWx8Tu10A7ykw111HZ5EDSn9zoKyk+Jz0W3PwktqgHWvGNpPXZ4jM:Nialcpx761B72S9z9yNRX/zU8En0p
TLSH
T1AD751212B762C0F1C49702755962D33EFB7062004BA9CDE7EBC46D60AD626E67A3B34D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1232	1C0F0F0C120C156A155E15B0E0D160A0F160C.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3764	74a6543f8ce9e1c77fbe2a8eee925b7170e2c58b3d002ceac5c42687f2bf657f.exe
1232	1C0F0F0C120C156A155E15B0E0D160A0F160C.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74a6543f8ce9e1c77fbe2a8eee925b7170e2c58b3d002ceac5c42687f2bf657f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1C0F0F0C120C156A155E15B0E0D160A0F160C.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 1232	3764	74a6543f8ce9e1c77fbe2a8eee925b7170e2c58b3d002ceac5c42687f2bf657f.exe	87

C:\Users\Admin\AppData\Local\Temp\74a6543f8ce9e1c77fbe2a8eee925b7170e2c58b3d002ceac5c42687f2bf657f.exe
"C:\Users\Admin\AppData\Local\Temp\74a6543f8ce9e1c77fbe2a8eee925b7170e2c58b3d002ceac5c42687f2bf657f.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Users\Admin\AppData\Local\Temp\1C0F0F0C120C156A155E15B0E0D160A0F160C.exe
  C:\Users\Admin\AppData\Local\Temp\1C0F0F0C120C156A155E15B0E0D160A0F160C.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1C0F0F0C120C156A155E15B0E0D160A0F160C.exe

Path C:\Users\Admin\AppData\Local\Temp\1C0F0F0C120C156A155E15B0E0D160A0F160C.exe
Size 1.6MB
SHA256 75feb720117a72f6a91cb827b1be3b57b36b34088d4924d11ec0f717f2011ae2
MD5 afa0f04a2623ef8b186ef75761426541
SHA1 ece2a06b0eda0f8c789bb11b4a02eeb67f63b8ee
SHA512 a5cc6ee3fed92efa5329b29d0a806d3bc9ce2adf06858171e238ed7b717aff4013076d7c17244f2b50131dd597e78f39b262f4734ccd80c663bd3079ce3b7f7d
SSDEEP 24576:6JHPLxGSxZHRWx8Tu10A7ykw111HZ5EDSn9zoKyk+Jz0W3PwktqgHWvGNpPXZ4jM:6ialcpx761B72S9z9yNRX/zU8En0p
TLSH
T1F5751212B762C0F1C49702755962D33EFB7062004BA9CDE7EBC46D60AD626E67A3B34D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1232-7-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/1232-10-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/1232-11-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/3764-0-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/3764-1-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/3764-9-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads