Analysis
- max time kernel
150s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/10/2026, 18:29
Behavioral task
behavioral1
Sample
d.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d.exe
Resource
win11-20260911-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target d.exe
- Size 227KB
- Sample261024-w45tyafe28
- SHA256 4a8113d35c0d7d42be9ba0848fc645c45a894f175c15055cc9ee7391ad8f8fad
- MD5 0ab7156481007d9a4ebae53b1b035930
- SHA1 6a93c1ba46925c349c8f7f6152c09bfb74573de5
- SHA512 1bad2f1d493236a98dcd9f02decd1f34bfa281dc8d2c932fdc229a278d368379bb6d93ddd45d3565ebe371c8a2cf0dfe6fa867a05923ebc23814e7255a90e611
- SSDEEP 1536:eWWA8DnYNe0J5T6DewsNMD1XExI3pmLm:T8DnZux6DewsNMD1XExI3pm
- TLSH T10234D4C5BB9BA944D1EC0A3098E5C43DC5377D33B8E2960AB9F37A9F16317818C44E92
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d.exe - Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe Token: 33 4704 d.exe Token: SeIncBasePriorityPrivilege 4704 d.exe