26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2.exe
Size 2.7MB
Sample261110-m4breshv7r
SHA256 26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2
MD5 7f9e3b68a0328b0bb096bb820ca50283
SHA1 5d7da6694fc223cf6eb1680090d1ec917c87ce3e
SHA512 fdc3098f62cc329c1f16d1bf52d9770e0a4a4c143833ec4147b613802d8a0eb0f5e0d8eff1428116f858ecd2c5b18389cb0b62f8f4801fad90d684124fa7d80c
SSDEEP 49152:rUe0UqdHM6HTYSloWb0Tg0OMLY+5lhbzLsMFRIbiJeezSeA:ge0m6/oI8L/RezaSeA
TLSH
T11BD56C27B38C613ED8EA193B453FA754A93B666166028C7757E0088CCF357817A3EB47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D26CA0-F514-7888-9CD6-3D41390959D2}\InprocServer32\ = "734F5653447778554D732F53615557644478387050767142734F2B504F727A6E4C426D7A65505546624F3262347162424F5168384942614169527541646C4432496154794D4C4978517236500D0A56763152416964306F4969514967466D4C6558396F6A69334C7578323172344533334F6558334B435A446C434D6B4545635A6450"	26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4D26CA0-F514-7888-9CD6-3D41390959D2}	26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4D26CA0-F514-7888-9CD6-3D41390959D2}\InprocServer32\ = "734F5653447778554D732F53615557644478387050767142734F2B504F727A6E4C426D7A65505546624F3262347162424F5168384942614169527541646C4432496154794D4C4978517236500D0A56763152416964306F4969514967466D4C6558396F6A69334C7578323172344533334F6558334B435A446C434D6B4545635A6450"	26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D26CA0-F514-7888-9CD6-3D41390959D2}\InprocServer32	26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4D26CA0-F514-7888-9CD6-3D41390959D2}	26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4D26CA0-F514-7888-9CD6-3D41390959D2}\InprocServer32	26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1900	26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2.exe

C:\Users\Admin\AppData\Local\Temp\26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2.exe
"C:\Users\Admin\AppData\Local\Temp\26b2f2e64e34ee59ce58d3b32ad398b53fd2781984191e5302d966c917f69de2.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-0-0x00000000019D0000-0x00000000019D1000-memory.dmp

Download

memory/1900-1-0x0000000000970000-0x0000000000C2D000-memory.dmp