Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 12:31
Behavioral task
behavioral1
Sample
648253b4c39b17134960d75033074a9a43cd3ccbae03cbca92aaebdca48ba589.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
648253b4c39b17134960d75033074a9a43cd3ccbae03cbca92aaebdca48ba589.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 648253b4c39b17134960d75033074a9a43cd3ccbae03cbca92aaebdca48ba589.exe
- Size 8.7MB
- Sample261107-pp53tsds3k
- SHA256 648253b4c39b17134960d75033074a9a43cd3ccbae03cbca92aaebdca48ba589
- MD5 c67e2ea02bccc2525ededfae90c6ddd0
- SHA1 ba38cab51212a6c2fa14df4f69eade823437f0e0
- SHA512 c738267b75f5567c38a05be031ce955b0371d93a1bad840f72ea0182c29fa6732110070b81c33221e7b8c638e9788fba3854a59a4aaab5e641d6ea4fb1061461
- SSDEEP 98304:5Sj6FVyQbAeLWCJ4u97hdBjEVHE7OBP0MfG:P6/+dOBMMu
- TLSH T165966B25F582A87BC2B60275B07A2316EA7446765300C8D7BABCD89C9FB2DC24177F5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 3452 648253b4c39b17134960d75033074a9a43cd3ccbae03cbca92aaebdca48ba589.exe 3452 648253b4c39b17134960d75033074a9a43cd3ccbae03cbca92aaebdca48ba589.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 648253b4c39b17134960d75033074a9a43cd3ccbae03cbca92aaebdca48ba589.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3452 648253b4c39b17134960d75033074a9a43cd3ccbae03cbca92aaebdca48ba589.exe 3452 648253b4c39b17134960d75033074a9a43cd3ccbae03cbca92aaebdca48ba589.exe 3452 648253b4c39b17134960d75033074a9a43cd3ccbae03cbca92aaebdca48ba589.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\648253b4c39b17134960d75033074a9a43cd3ccbae03cbca92aaebdca48ba589.exe"C:\Users\Admin\AppData\Local\Temp\648253b4c39b17134960d75033074a9a43cd3ccbae03cbca92aaebdca48ba589.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3452
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\HPSocket4C.dll
- Size 2.1MB
- SHA256 23078015adb0cf53ebf632a895a1a224b3718174e6c2887e1bbb2d28be5e2b8b
- MD5 04869ada712c189caba4822be0e81ea5
- SHA1 9c45486b30e6d3ccf0737c5766796baaf58232ab
- SHA512 16f98af15583c60da0cb947ea2230f759bfa27f86ef93ef5f7ffe2adcec6c5f115f52ffa74bae6cf8add94bb6a380fa276f391619256be7a45c53bb7421fdd9c
- SSDEEP 49152:haJYXtLKIrdBjE2LsTwIRE7uO6lpdP0HTTkixwuz:h7hdBjEVHE7OBP0M
- TLSH T1E9A5BF02FB8684B2E9DD067A527A677F4E39EA150329D9C3DFA03C695C301D2663D38D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll
- Size 98KB
- SHA256 7a7f037bab8024a9d17fb225cc4aa04133081135ecc4be5bbb889c0fbebd7e0c
- MD5 1dd2a4a0f4d21eb65db5895fca2ca489
- SHA1 b0c0617f6f66b35e255ec9824cde41f382a60e80
- SHA512 214e7aa56e820ebec87a778293871672f7c4e92d06bdf5ba18a2fc536003b2e15ebdce65c1ae3c927a16fcfe865c1720a7262e7a700459c66b4ae563374518ae
- SSDEEP 3072:lpuZ4KjoGDr8uuoP30t7JdjoS6JOe1R8h:SZ4yYoP30t7rDt9
- TLSH T11DA30246B7667923E8E383FEB16C47DAFC337607F8F5953A2B514A1938943877284142
- MD5 SHA1 SHA512 SSDEEP TLSH