f530898849c5046bb0d7f909d92c914bbf0d8f0ef8deb55867f100766ad139ca

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f530898849c5046bb0d7f909d92c914bbf0d8f0ef8deb55867f100766ad139ca.exe
Size 1.8MB
Sample261027-jf1tvsstdt
SHA256 f530898849c5046bb0d7f909d92c914bbf0d8f0ef8deb55867f100766ad139ca
MD5 9c9509dceeab7c16e08b28dee1a03d8f
SHA1 5b07e6573ac2e3fc63171de718a1c70392faeac9
SHA512 b596f219a102f2d952085678482ae4b3b89d30dd5f010ca8b985cc7351404065740605ef2f672139e8d4f363077491b7c3160bd4fec67d8cd8bafdc1752d7589
SSDEEP 24576:gbHUmYdvpBQ0dvpBQ843Rl2ORRVSswaq:yHUmY1LZ1L5MRl2IRVSLaq
TLSH
T1BC957236E6CBAA95C4445E70013219B9126B7FB93837F50FEA0E7975EB732C36905A03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	f530898849c5046bb0d7f909d92c914bbf0d8f0ef8deb55867f100766ad139ca.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	f530898849c5046bb0d7f909d92c914bbf0d8f0ef8deb55867f100766ad139ca.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f530898849c5046bb0d7f909d92c914bbf0d8f0ef8deb55867f100766ad139ca.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
912	f530898849c5046bb0d7f909d92c914bbf0d8f0ef8deb55867f100766ad139ca.exe

C:\Users\Admin\AppData\Local\Temp\f530898849c5046bb0d7f909d92c914bbf0d8f0ef8deb55867f100766ad139ca.exe
"C:\Users\Admin\AppData\Local\Temp\f530898849c5046bb0d7f909d92c914bbf0d8f0ef8deb55867f100766ad139ca.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads