Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 07:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d1a865eac75b82095dc9d955fc74ec49f8c0ec7a85f6ce113df736a9a96069f4.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
General
- Target d1a865eac75b82095dc9d955fc74ec49f8c0ec7a85f6ce113df736a9a96069f4.exe
- Size 1.8MB
- Sample261027-jldxaada44
- SHA256 d1a865eac75b82095dc9d955fc74ec49f8c0ec7a85f6ce113df736a9a96069f4
- MD5 22d14afe80347bf528cd5db8deed9cd3
- SHA1 59c7afd353a432a0b97a69ac6007f778431aa2d0
- SHA512 244664ff4b87712ae0b1731a69d8c61fd286c00d92529ae75248d656ef97bdba2bf90c90114df3602cf5d7d9a4186a0de7f82c63a5954fc3e9b40b87933ea156
- SSDEEP 49152:q3woVAyLrdWu5bXbnm1mom+s8KuqGaX0ToIBAUZLYwuBJh:kUu5zjmssJBAUZLWBJh
- TLSH T1DE95E012F382C5B3E5175531487B7B3ACA3AFD620F15CA43B3A4FFAE1C722A0955614A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4724-0-0x0000000002470000-0x0000000002496000-memory.dmp upx behavioral2/memory/4724-1-0x0000000002470000-0x0000000002496000-memory.dmp upx behavioral2/memory/4724-2-0x0000000002470000-0x0000000002496000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d1a865eac75b82095dc9d955fc74ec49f8c0ec7a85f6ce113df736a9a96069f4.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4724 d1a865eac75b82095dc9d955fc74ec49f8c0ec7a85f6ce113df736a9a96069f4.exe 4724 d1a865eac75b82095dc9d955fc74ec49f8c0ec7a85f6ce113df736a9a96069f4.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4724 d1a865eac75b82095dc9d955fc74ec49f8c0ec7a85f6ce113df736a9a96069f4.exe 4724 d1a865eac75b82095dc9d955fc74ec49f8c0ec7a85f6ce113df736a9a96069f4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1a865eac75b82095dc9d955fc74ec49f8c0ec7a85f6ce113df736a9a96069f4.exe"C:\Users\Admin\AppData\Local\Temp\d1a865eac75b82095dc9d955fc74ec49f8c0ec7a85f6ce113df736a9a96069f4.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4724