928d395179ed2aeaead1b9c550275efcaff241296b6403a14b788207826cc28d

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

928d395179ed2aeaead1b9c550275efcaff241296b6403a14b788207826cc28d.exe
Size

519KB
MD5

3e0be55df7146f370400362b0f46bce0
SHA1

b1363f2e5fe43f3ae5ccf3869fc4f3671a4beab1
SHA256

928d395179ed2aeaead1b9c550275efcaff241296b6403a14b788207826cc28d
SHA512

7ca427c8d3341c14e7f4c930d3b46a35d1e0fae5c4c8a4e3b053aa6d7db01f677435130ebb1908fd30e1d03576b503c458497ebc097dc38a108489359199426f
SSDEEP

12288:KkKs0tVBpLFt3fBXbp4x5SSaP0nkA+LkS1i:DHI7Ft3fBXex5SSaMnyT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	928d395179ed2aeaead1b9c550275efcaff241296b6403a14b788207826cc28d.exe

C:\Users\Admin\AppData\Local\Temp\928d395179ed2aeaead1b9c550275efcaff241296b6403a14b788207826cc28d.exe
"C:\Users\Admin\AppData\Local\Temp\928d395179ed2aeaead1b9c550275efcaff241296b6403a14b788207826cc28d.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4120-0-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/4120-2-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download