07d9e736d8bab4eef8c324fbcc39236f4a14fda30c9fe4f0cb3bd9b12cb8fe6a

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
07d9e736d8bab4eef8c324fbcc39236f4a14fda30c9fe4f0cb3bd9b12cb8fe6a.exe
Size 1.6MB
Sample261011-ragg2aah26
SHA256 07d9e736d8bab4eef8c324fbcc39236f4a14fda30c9fe4f0cb3bd9b12cb8fe6a
MD5 ce493963c208ef3971b5038dc6bf1eea
SHA1 3df40833a0f7e07e97862f3cec185037bf011cb5
SHA512 637df0815ce1dd3159750c24ffa3a311e04f94fd7579c91ab458b5fa589928b3c66918058209dfb0620ff19d9b7de16ea550b6a37a3c98d27e44e44f12d22052
SSDEEP 24576:+JHPLxGSxZHRWx8Tu10A7ykw111HZ5EDSn9zoKyk+Jz0W3PwktqgHWvGNpPXZ4jM:+ialcpx761B72S9z9yNRX/zU8En0p
TLSH
T14A751212B762C0F1C49702755962D33EFB7062004BA9CDE7EBC46D60AD626E67A3B34D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4196	1C0C0F0A120C156B155D15D0F0C160E0E160F.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3752	07d9e736d8bab4eef8c324fbcc39236f4a14fda30c9fe4f0cb3bd9b12cb8fe6a.exe
4196	1C0C0F0A120C156B155D15D0F0C160E0E160F.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07d9e736d8bab4eef8c324fbcc39236f4a14fda30c9fe4f0cb3bd9b12cb8fe6a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1C0C0F0A120C156B155D15D0F0C160E0E160F.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 4196	3752	07d9e736d8bab4eef8c324fbcc39236f4a14fda30c9fe4f0cb3bd9b12cb8fe6a.exe	89

C:\Users\Admin\AppData\Local\Temp\07d9e736d8bab4eef8c324fbcc39236f4a14fda30c9fe4f0cb3bd9b12cb8fe6a.exe
"C:\Users\Admin\AppData\Local\Temp\07d9e736d8bab4eef8c324fbcc39236f4a14fda30c9fe4f0cb3bd9b12cb8fe6a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Users\Admin\AppData\Local\Temp\1C0C0F0A120C156B155D15D0F0C160E0E160F.exe
  C:\Users\Admin\AppData\Local\Temp\1C0C0F0A120C156B155D15D0F0C160E0E160F.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1C0C0F0A120C156B155D15D0F0C160E0E160F.exe

Path C:\Users\Admin\AppData\Local\Temp\1C0C0F0A120C156B155D15D0F0C160E0E160F.exe
Size 1.6MB
SHA256 5ef240e06b6d1996ffcd8b830319f4c7d24f01f169049b378b54c88ccd53d546
MD5 d5efc629d386deb46d6e518d74efd464
SHA1 b55f03a885118fd732cad9ad76fea2a308faef4a
SHA512 431b3a976f8ee58d83de4f1fc9c1e1c68757063faad8ef4f76b277894be43c805896b166701a1a736798bc5128ac8503368d6b8881f581ee986603d0bfb7d47d
SSDEEP 24576:XJHPLxGSxZHRWx8Tu10A7ykw111HZ5EDSn9zoKyk+Jz0W3PwktqgHWvGNpPXZ4jM:Xialcpx761B72S9z9yNRX/zU8En0p
TLSH
T1B6751212B762C0F1C49702755962D33EFB7062004BA9CDE7EBC46D60AD626E67A3B34D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3752-0-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/3752-1-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/3752-9-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/4196-8-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/4196-10-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

memory/4196-11-0x0000000000400000-0x00000000005A32B8-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads