3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6.exe
Size 1.9MB
Sample261104-2dgmbady4t
SHA256 3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6
MD5 90c90c86ed73f8ca244b0dcd8c1cba26
SHA1 6eb9df60f4593bc7c4990c43d0da3818efef5b54
SHA512 6d6725cd782eea9908dd50f981ddbe253c04ce55afeb6b0f1dbf330b2f8ccd989176c0e483b8065c7bd12c86c58b6e2d5b1e8711f3e1c23556e2dfc28f25214b
SSDEEP 49152:GmqeUa1gllIIWJ2QEZ8ypUfkptVxsCAp:GTRug7fpUu5sC
TLSH
T1D2957C12BAD99032F1B317319DB983199674B8A6873685DFB2CC524E5F709C18B36F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3292	3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6.exe
3292	3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6.exe

C:\Users\Admin\AppData\Local\Temp\3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6.exe
"C:\Users\Admin\AppData\Local\Temp\3c6a504003947b0d4b9b6e86aa65118794433cbaf09360c032179220b4226ed6.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

au.msi

Path C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_511\au.msi
Size 843KB
SHA256 109bc0521654c3a013e7203ffc681a273b64531d6203fa3a3ecff837875e0fe3
MD5 44b67e55c21165ffdf039de34b3b9300
SHA1 0ee5422997e373ca3c0718df6e7ae0c6a7cf720b
SHA512 66dc6eb397a3f9721ecdb1244c078e697eab41b7b074c6fecc635a86400318b15f34b266ee472433b81c39032286b6d1a1418c9451024e44290ce84c91707131
SSDEEP 24576:UMGn0BAcfLf/A9CLNsoWYyjhzGrcrdN/4Bg8:UMGn0ycT/A9ANgdGwRV58
TLSH
T1E905236D127862FB4F236ED108C4DFEBD34906C63AB563074BD94399A49AC60BF1E16C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jre1.8.0_511.msi

Path C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_511\jre1.8.0_511.msi
Size 42.4MB
SHA256 7f622cfe8702eacce265135ff0b83961b5bef5dea8b8c22835f0dc0f0560871d
MD5 c3567f02e3b27c06d29c246a2bc0a0b8
SHA1 2f6fb6b71b7805ad98a6dc8bb482efa3c65e7693
SHA512 9a40dad2cd6f8dd4bd2e95620b93529c124d73d7ed3b8be0e3b2b06d4f3288abee6332f2df75dcf81e3328ccb82fe43e23e759f8b37da0f67807013b33e3f5ae
SSDEEP 786432:ZZWyFJOEjV2t+x05e6WEY2UD85+57ueflHq5UH5MOXY0623hCsth1DTgZdi2A+ck:uKG+SMtf1157hflKxOXO2xC8h9P2A+u+
TLSH
T1D7A7334F98B1C21626BD1D99BDB7224FFD9D6880A3F5ECA3DB2249CB0CD90354E65309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 a6cc2420809413451469e0bf984b6d9f2472bd89bc650422c17a7bbb1d99b291
MD5 e15d3c04af6687bcbcf87faef7a16cbe
SHA1 e00f737ef68e45c3610c9bf77d1923e9e10f99b3
SHA512 cbe12e6e99c25f5fe18b283e5fe0159e3b1099cbf93add7a19e85c5b79ee9e2f6616a5336396b4c25933682751713d27f74148665f102962a720169b79bcb3f0
SSDEEP 3072:YyDJ0BPPt3zWQAJdB9RqPrBXUMmpp7dyO0+keVWh3MtM:1X2R
TLSH
T16DF37387C66E44BF30530BA7C37A9C585666171D935E4E1C61EF82CEE081E03C6AE5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads