491971b8d8f0cb81204c03994b97ad099e2641ad49e7e1ed31f0db4b1bfc9b2f

Analysis

max time kernel
5s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
06/08/2024, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

StandKnife Reborn.exe
Size

382KB
MD5

0b3f25a8cc3caa5c9282e9560737d543
SHA1

66bb7222446b4cb46d375b17e9285c1793e57644
SHA256

491971b8d8f0cb81204c03994b97ad099e2641ad49e7e1ed31f0db4b1bfc9b2f
SHA512

a1b77f81f437f230fc42d2c588810681a6faa79e9097ceb342ba53bff2ad8d4697407c16e3b49cc9d7abe06ee19f03b1393629a8b9e8efe3d1b2ffa0b10831f6
SSDEEP

6144:JkkThEKkKal/pdB4ByslALDoD8yNdkdSoQQFFT/ddXd9dMddlyzdppvvs5iN4HhL:iyhEKkRTYlALGkFFlvsW4HhBV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StandKnife Reborn.exe

C:\Users\Admin\AppData\Local\Temp\StandKnife Reborn.exe
"C:\Users\Admin\AppData\Local\Temp\StandKnife Reborn.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads