21432db11f8010c676abd84e8bc700f87001def0bdb3736b03a78384e7a989dd

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 20:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
21432db11f8010c676abd84e8bc700f87001def0bdb3736b03a78384e7a989dd.exe
Size 1.8MB
Sample261027-y9fs4sfy21
SHA256 21432db11f8010c676abd84e8bc700f87001def0bdb3736b03a78384e7a989dd
MD5 2585fbd51061fc286bcea970879e7c9a
SHA1 751f247387cdb113c1b8dfd72110059b74ce709b
SHA512 4d0871b5aa41e9046597e4a62eb36361c10bd686dbfe8b1d0d9ead460ce697096d9cb7e8eee716a10e480755ea7c1932476d491267015d8e39922af1372e7ccb
SSDEEP 24576:p6nVMk+HIj90cMOFRBoYSX6/8wmqY70BxLRgdI/zVcasZMcN8uO2Kw7Or/9fpScz:cVz7tPPBx+0r13zetZMcN/NHOr/9f3l1
TLSH
T1F2952202BBC48572E83215308AE587E52B7D2E306F944DDBA3D53BAC6A714C39635F63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Easeware\DriverEasy	21432db11f8010c676abd84e8bc700f87001def0bdb3736b03a78384e7a989dd.exe
File created	C:\Program Files (x86)\Easeware\DriverEasy\__tmp_rar_sfx_access_check_240720390	21432db11f8010c676abd84e8bc700f87001def0bdb3736b03a78384e7a989dd.exe
File created	C:\Program Files (x86)\Easeware\DriverEasy\DriverEasy.exe	21432db11f8010c676abd84e8bc700f87001def0bdb3736b03a78384e7a989dd.exe
File opened for modification	C:\Program Files (x86)\Easeware\DriverEasy\DriverEasy.exe	21432db11f8010c676abd84e8bc700f87001def0bdb3736b03a78384e7a989dd.exe
File created	C:\Program Files (x86)\Easeware\DriverEasy\Easeware.Driver.Core.dll	21432db11f8010c676abd84e8bc700f87001def0bdb3736b03a78384e7a989dd.exe
File opened for modification	C:\Program Files (x86)\Easeware\DriverEasy\Easeware.Driver.Core.dll	21432db11f8010c676abd84e8bc700f87001def0bdb3736b03a78384e7a989dd.exe
File opened for modification	C:\Program Files (x86)\Easeware	21432db11f8010c676abd84e8bc700f87001def0bdb3736b03a78384e7a989dd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21432db11f8010c676abd84e8bc700f87001def0bdb3736b03a78384e7a989dd.exe

C:\Users\Admin\AppData\Local\Temp\21432db11f8010c676abd84e8bc700f87001def0bdb3736b03a78384e7a989dd.exe
"C:\Users\Admin\AppData\Local\Temp\21432db11f8010c676abd84e8bc700f87001def0bdb3736b03a78384e7a989dd.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads