511b01c958591807a6ce13b59f3d211576749f0074610f42dd5e2a44860a14c2

Analysis

max time kernel
95s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81d80b90eef28575ea97ccd240fe6bb4.exe
Size

1.1MB
MD5

81d80b90eef28575ea97ccd240fe6bb4
SHA1

8dc69d9af765c84032cb6e44517ab51efe0e0727
SHA256

511b01c958591807a6ce13b59f3d211576749f0074610f42dd5e2a44860a14c2
SHA512

5df730f6614268a29f30d91c2fb582f7a01f65d4df9ae56d3b511fff5c9d8904a65165c5b2ca23dbf9a00b0be2b3845cf67d207846a85b1bd66e2316d58a9362
SSDEEP

24576:2VOlRgi+jIBVelUAvbUFUupC0f3/Jy7WKcxRVjlxEEcs:2egi+OklUMbUSupR86VZSs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81d80b90eef28575ea97ccd240fe6bb4.exe

C:\Users\Admin\AppData\Local\Temp\81d80b90eef28575ea97ccd240fe6bb4.exe
"C:\Users\Admin\AppData\Local\Temp\81d80b90eef28575ea97ccd240fe6bb4.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3932-1-0x0000000002260000-0x0000000002344000-memory.dmp

Filesize
912KB

Download
memory/3932-0-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download