4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54e54se34sde45e4.exe
Size 604KB
Sample261027-xdlttaec65
SHA256 4545b3c3309358a657d4f48a441728bd2cddd2df22d05a21df973311fb91b00c
MD5 77c9f45ba9801e889db7195e36abef03
SHA1 65db9681e800ebd2af716972cfa0e2c3bf08ec0a
SHA512 21b967ec4806dc1bb1096f9083fe2d45525d19d1a86bef9d3af8075c56ba59987e2587ccd47675270f6a275755fb431723552f84633824cec5517b235c414e57
SSDEEP 12288:R3mgqnIZuYfCYqFet4CovkM7c6GnEIRAQRFehgtq:R3WnIZuMCxezot716BAQRFEOq
TLSH
T106D48D32A5614033FBF10573B928A6303E7CE728275188A9D7D4AD1D7EB8482A7F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4900	54e54se34sde45e4.exe

Loads dropped DLL 1 IoCs

pid	Process
4900	54e54se34sde45e4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54e54se34sde45e4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54e54se34sde45e4.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4900	54e54se34sde45e4.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5604 wrote to memory of 4900	5604	54e54se34sde45e4.exe	88

C:\Users\Admin\AppData\Local\Temp\54e54se34sde45e4.exe
"C:\Users\Admin\AppData\Local\Temp\54e54se34sde45e4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Windows\Temp\{1AB37EF0-8C41-4E0E-B139-C1B13E7A11D0}\.cr\54e54se34sde45e4.exe
  "C:\Windows\Temp\{1AB37EF0-8C41-4E0E-B139-C1B13E7A11D0}\.cr\54e54se34sde45e4.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\54e54se34sde45e4.exe" -burn.filehandle.attached=764 -burn.filehandle.self=768
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wixstdba.dll

Path C:\Windows\Temp\{05264954-B3CE-4839-8C95-2B9187253119}\.ba\wixstdba.dll
Size 205KB
SHA256 b7de0a0ca3a94738747abd708e30ba1f9638a8c8b7d8173c76d4f39fae3d9346
MD5 87c8a7ea44e8ee0d9358e25b7dcd397d
SHA1 0e2021be823fee499175d2c0d68346d15c02a376
SHA512 98b5bbe5bb3ec331a0025e3da209296050b2f695be5a4b90b5c939f8fbbaada6dd93483eba779c10151546c2798aab5282fa619a55ec0cf04f56a03795a0a3f5
SSDEEP 3072:tEIwsGi6eTe5uBR3SupIu+ieZpKamkOLCaQuEsSyhssS2KPjbfkd4qhgTrm9b3EJ:tEZdi6e93SuDeTKZxQfsRy26BqbUHF
TLSH
T18524AE12F5D0907AEBFB1930593AA6206DBDB9200FA0C9CE53486D2B6E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54e54se34sde45e4.exe

Path C:\Windows\Temp\{1AB37EF0-8C41-4E0E-B139-C1B13E7A11D0}\.cr\54e54se34sde45e4.exe
Size 588KB
SHA256 6ad729bd8cc858d843942415c6477f3165733fd17c39562507f863e495e64942
MD5 c838c56b493f6f1d0a2bc4cf731b7152
SHA1 1975bbb00156d3901578d7ba6d2867601e2a55ca
SHA512 e4242b67808cbf9dcfbc1b4e3e046122a5a7b34ff7504b489e3e9e7ba63c7a770a6f4d157011616805d773c195b0704f4817f48dab99f0d1862728de027f2177
SSDEEP 12288:R3mgqnIZuYfCYqFet4CovkM7c6GnEIRAQRFehgP:R3WnIZuMCxezot716BAQRFEE
TLSH
T13CD47D32A5614033FBF10573B928A6303E7CE728275188A9D7D4AD1D7EB84C2A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH