db92a372a506522f5b12e2a9238205d73a1121add5324c56728836a28fb65106

Analysis

user interaction
yes
max time kernel
102s
max time network
33s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/10/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Admintool.exe
Size 946KB
Sample261026-1dletsca44
SHA256 db92a372a506522f5b12e2a9238205d73a1121add5324c56728836a28fb65106
MD5 307492a630ee58cbe2e4f1f6aca09fb8
SHA1 0e2c21d0657e3c4bc64386372c09edc2423c4f31
SHA512 96259db4f64d58d2c5d5fcce67841bb16638190c936ab795191580c0281a514b449951f399f7972c338d8e8f0a9edc02594379ac0751d68e4f4b2846e85b60f0
SSDEEP 24576:osiHCC54ViVyJtqzqv9IdHHyGeQl561Lmhsfmc:/CKAESVVum6f3
TLSH
T143259F61F4C150A6C640307491ABE736947BDF771334ADC3A7A47DAA3A64AC2ED3B309
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admintool.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3660	Admintool.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3660	Admintool.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3660	Admintool.exe
3660	Admintool.exe

C:\Users\Admin\AppData\Local\Temp\Admintool.exe
"C:\Users\Admin\AppData\Local\Temp\Admintool.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hotkeys.ini

Path C:\Users\Admin\AppData\Local\Temp\Hotkeys.ini
Size 371B
SHA256 b8bd1d791dccb164796cce9134b447e6674acd0d8ec62e46f1d35029a86689f4
MD5 904e20a7222957e378775c4f7028d6f4
SHA1 f112a4d0cd4678486d836d549e22975647c8e850
SHA512 82d797b0c09bc6e1ac643354ae6634fbc31a40bcf2f42461eb44c3911c51aaec504edd5b06285bf704880ef0d541fc8690a45e70e9fd7f2988a53d452f402fe5
TLSH
T1B4E0D8F03101BA09216A16A95580AD1618FF73D0D5E7934EFA5253F33D8458F3B25629
MD5 SHA1 SHA512 TLSH

Submit Download

log.txt

Path C:\Users\Admin\AppData\Local\Temp\log.txt
Size 1KB
SHA256 87cdcf7526822f93d19da428cdf84ba053ce3bbf8e03893625200918a9d76cdc
MD5 d9b3e8f26d52388fc13222ebdfabc9fc
SHA1 5954c433a24cf72ad6e7bbc0fbe04cc44c199a03
SHA512 cdc8ada919372cbd0f90e91141acdbafcd42239990b8561928ff8cba084a697414d35b1f2c35bb8430bb100676be51d2f253f47eb22f844dcb789f1d67d5c79a
TLSH
T11341A06A7808E83BD3EE138C4505B964AD76F2DC858030CDF289A3A65CC796F05AED13
MD5 SHA1 SHA512 TLSH