b9504b0524a4cdf1d716cead9aefd3fd0666c70bed9e125215129da5501e9e8f

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b9504b0524a4cdf1d716cead9aefd3fd0666c70bed9e125215129da5501e9e8f.exe
Size 2.4MB
Sample261020-1bhadswtew
SHA256 b9504b0524a4cdf1d716cead9aefd3fd0666c70bed9e125215129da5501e9e8f
MD5 87063bab1b5585bc5cfc31425a4dd35b
SHA1 64fae896f0875aa2cb5df8a729e609220804ab46
SHA512 65198c85439313755edac22857b72773ca031d31860295e18bb79b2578739f9778f7644bb2aa069b8aa11d6f021ffaa6aff8a470013ad843a03dde53535938c4
SSDEEP 49152:lhq5FAZq1Zk7vSqoQQmpSKB2TSSxcW60rifNJDOt:lEAUGRRQmpS0MfG
TLSH
T18FC5B062B5838073E9924135AB7D6F369C6EA1341335C1C3A3D40D6D5C62DE2EA3A3B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DwProxy.ini	b9504b0524a4cdf1d716cead9aefd3fd0666c70bed9e125215129da5501e9e8f.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9504b0524a4cdf1d716cead9aefd3fd0666c70bed9e125215129da5501e9e8f.exe

C:\Users\Admin\AppData\Local\Temp\b9504b0524a4cdf1d716cead9aefd3fd0666c70bed9e125215129da5501e9e8f.exe
"C:\Users\Admin\AppData\Local\Temp\b9504b0524a4cdf1d716cead9aefd3fd0666c70bed9e125215129da5501e9e8f.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DwProxy.ini

Path C:\Windows\DwProxy.ini
Size 88B
SHA256 13b4753f4b24dc948d4a4927a5d95f99c93324fd74e111330a262c7e79e8a77a
MD5 51c1def524c5d410a0898a3fffbfc976
SHA1 3ccda2d08d6596def1640fc9a2e989429c28de41
SHA512 d4400921b7d61dfba4b188629c3f8f90ba84a4ea27dd5411479c4385b358546703530590db237ebaa98f755683ca5abdc10f6639ece513d87294479a6181ac1d
TLSH
T14BB00140CB16E51D00F8E2E67AE085964AC30A46184AE12267620E7404F8AB2B9EE49D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5052-0-0x0000000000310000-0x00000000006B9000-memory.dmp

Download