d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe
Size 4.9MB
Sample261102-knahba11es
SHA256 d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13
MD5 102887e6b13a41c21bacd8789f39e665
SHA1 577b0f47c54b3b5ef896988890e1b03f1bcbaba7
SHA512 2eee137a1c0ce0da51cada418ecd37cc3f098810fcce08b97bef0a40905ae8dce98f92e0c1f084e0696fb427fa8f4a71b50dd8db1d347ac4fa3116061f35e41e
SSDEEP 98304:v+VXwtnORYuZTiAhjJN88KqTh4PBKzUWbrB8a2znD9uwbA5HUQ:vkgtOCY68htA0zpbVfgq0Q
TLSH
T1B9360141F21AB8BAC11DA2F8477FD3757EB584B50A218ED3E3F4EE5C3C329506A26125
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4768	YTBV611.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4540 set thread context of 4768	4540	d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe	89

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\myset.ini	d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe
File created	C:\Windows\YTBV611.exe	d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4540	d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe
4540	d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe
4540	d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe
4540	d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4540	d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe
4540	d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe
4540	d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 4768	4540	d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe	89
PID 4540 wrote to memory of 4768	4540	d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe	89
PID 4540 wrote to memory of 4768	4540	d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe	89
PID 4540 wrote to memory of 4768	4540	d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe	89

C:\Users\Admin\AppData\Local\Temp\d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe
"C:\Users\Admin\AppData\Local\Temp\d1b38933a24b61a4742634f4022290ba3e1d981b902a28dc06d2033b2719cc13.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\YTBV611.exe
  C:\Windows\YTBV611.exe canshu
  2⤵
  - Executes dropped EXE
  PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YTBV611.exe

Path C:\Windows\YTBV611.exe
Size 425KB
SHA256 4961be984933bc7d5c72822a1186720c64ecd058bd826606b74b4ff3754a4c03
MD5 5d4e13b35fe7b11eb77a498f0fcba589
SHA1 25e32bed5f191b5549c58fed90c8c0b0db230afb
SHA512 1de07315d4dc3d3946170c6aa19c5925049bfb2cc571ca8b0cb804b393b5b1c144f13f938dc0a4bc2e04c1eae2a6cc5397542eee53c768f9b53dea27ee02fcae
SSDEEP 12288:uRMC9c1sUEWV4HO/eNBJQZjoez0w/60GeeSR1:GjksPW0zJSnzj/O5u
TLSH
T11F941294F21AB499C81682F0E79DC5B93228D47CAB022ECE9BBD3F2F3DD65749552020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4540-0-0x0000000000400000-0x0000000000911000-memory.dmp

Download

memory/4540-10-0x00000000027A0000-0x00000000027A1000-memory.dmp

Download

memory/4540-7-0x0000000010000000-0x000000001011C000-memory.dmp

Download

memory/4540-8-0x0000000010000000-0x000000001011C000-memory.dmp

Download

memory/4540-14-0x0000000077128000-0x0000000077129000-memory.dmp

Download

memory/4540-4-0x0000000010000000-0x000000001011C000-memory.dmp

Download

memory/4540-9-0x0000000077128000-0x0000000077129000-memory.dmp

Download

memory/4540-20-0x0000000000400000-0x0000000000911000-memory.dmp

Download

memory/4768-16-0x0000000000400000-0x0000000000A30000-memory.dmp

Download

memory/4768-21-0x0000000000400000-0x0000000000A30000-memory.dmp

Download

memory/4768-22-0x0000000000400000-0x0000000000A30000-memory.dmp

Download