25125853ab115eb4ab6fa20e3fd49206f1294437bdea52ddf119001f8fa0a83d

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25125853ab115eb4ab6fa20e3fd49206f1294437bdea52ddf119001f8fa0a83d.exe
Size 5.3MB
Sample261027-tyjcmsft4m
SHA256 25125853ab115eb4ab6fa20e3fd49206f1294437bdea52ddf119001f8fa0a83d
MD5 450707b91305fee033caecf642d6543e
SHA1 bd5fa0614d857a3eaf87b8caa7dd5c72e0b447af
SHA512 49d4069adaa36e81a5b35025b98eb77fb4e5742d6bd7b9d7ce5789ce72b9a447c1bc8eae1c1a17eebb325bd4cd15ea0252b66964223b7d2964b91f9ae963221c
SSDEEP 98304:zFb8OTvKoc4JOiuNS6T+ulxZWHDEx6j7r9Yl1F8ttS9iecGAbMNCmbIAGBi:zFXJ7hiXWjZP+l1FutuVAwNCmbIAGBi
TLSH
T1B6461322B64180F3C6491B3008EA673B9D316B594F20CEC7A3D4ED7A6F723D15A7629D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4460	25125853ab115eb4ab6fa20e3fd49206f1294437bdea52ddf119001f8fa0a83d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25125853ab115eb4ab6fa20e3fd49206f1294437bdea52ddf119001f8fa0a83d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4460	25125853ab115eb4ab6fa20e3fd49206f1294437bdea52ddf119001f8fa0a83d.exe
4460	25125853ab115eb4ab6fa20e3fd49206f1294437bdea52ddf119001f8fa0a83d.exe

C:\Users\Admin\AppData\Local\Temp\25125853ab115eb4ab6fa20e3fd49206f1294437bdea52ddf119001f8fa0a83d.exe
"C:\Users\Admin\AppData\Local\Temp\25125853ab115eb4ab6fa20e3fd49206f1294437bdea52ddf119001f8fa0a83d.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2EECore.3.5.241231.dll

Path C:\Users\Admin\AppData\Local\Temp\E2EECore.3.5.241231.dll
Size 11.1MB
SHA256 eaef25459ef08b8ac5bade805702f346599c1e22afb41d47dda3e935e7ade522
MD5 748a6d4af7ea571b9760c718822cd4ab
SHA1 0742c8635503f909f8e065c58a30afa24dd41fae
SHA512 7f5854b597c139619776fcd792f4e29465439f5a2101c21f3db77af4da5e90a2c4e906b87c230bb13e003e57d155fca88d096b2d07895623157a6e5e26e510dd
SSDEEP 196608:TbNRK74GxssSHqNCJ6njLsO7/zV4ahBZ6O5miAwVeks2VTi166GR:ThRK4GxyJ6njLnHV9hB4O5miAwVeBf12
TLSH
T1AFC69E00F743C1A2EACE01B0117AAB3E55397E5443252DD7F3583E6A6E322D27B3665E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4460-6-0x0000000010000000-0x0000000010059000-memory.dmp

Download