3c2678c224f3b8dcc17384724089c215602e76fa37e097226fd58e1d5bfac7b6

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c2678c224f3b8dcc17384724089c215602e76fa37e097226fd58e1d5bfac7b6.exe
Size 519KB
Sample261011-psbcmaaw4p
SHA256 3c2678c224f3b8dcc17384724089c215602e76fa37e097226fd58e1d5bfac7b6
MD5 b2893e7ab17d74fda1ab0257310a6a33
SHA1 0a4b827cfcd528fb5dadc963ccfbebb79bc9351b
SHA512 9575b8e45367933c3eacd621256c2b0f00bc5bfdd80db3f25b48fe8ff88ec652457df7137989cd60d5a3c6b3bb5f30f15a385aa8d6c4bf7fcde4ef83234e3b54
SSDEEP 6144:6Ef2V1cryPbxRosbb5bLkOgPXjLmU8KFjirBcEOkCybEaQRXr9HNdvOa:6VVOrYZbIOgPXjLmUahOkx2LIa
TLSH
T145B47C2AF6A0C037C5B79674C4A246A7FBB1742237614ACFA39047561F637A2BE3530D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3660-0-0x0000000000630000-0x00000000006BA000-memory.dmp	upx
behavioral2/memory/3660-1-0x0000000000630000-0x00000000006BA000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2276	3660	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c2678c224f3b8dcc17384724089c215602e76fa37e097226fd58e1d5bfac7b6.exe

C:\Users\Admin\AppData\Local\Temp\3c2678c224f3b8dcc17384724089c215602e76fa37e097226fd58e1d5bfac7b6.exe
"C:\Users\Admin\AppData\Local\Temp\3c2678c224f3b8dcc17384724089c215602e76fa37e097226fd58e1d5bfac7b6.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 472
  2⤵
  - Program crash
  PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3660 -ip 3660
1⤵
PID:5932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3660-0-0x0000000000630000-0x00000000006BA000-memory.dmp

Download

memory/3660-1-0x0000000000630000-0x00000000006BA000-memory.dmp