22dc46ff057d70615ed70808fd3ec8770aa2d385d79938018c8ab64f68b83276

Analysis

max time kernel
141s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22dc46ff057d70615ed70808fd3ec8770aa2d385d79938018c8ab64f68b83276.exe
Size

674KB
MD5

884756028bc021fe22771fa2ce223877
SHA1

2e17cc09c0a339101a47c5c5dd0369725211fce5
SHA256

22dc46ff057d70615ed70808fd3ec8770aa2d385d79938018c8ab64f68b83276
SHA512

22b1494cebd6f373d79ecdf0cb81ebcb02b21ff3c5c4bdfe3fbb62f5844311e0fe7a8e37155a2ca8000e585fb404d80afbb88e8300d14fff3d8ee2af41ed1704
SSDEEP

12288:Vfvvzli4FUSFspBCzNM9FPLc6nujcwT+j9OhcwEXxmwYeLTcBJ/jeqm71YwVey8J:VfnlUSOrzFPwcwT+mcwJeLA//ja1YwVS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22dc46ff057d70615ed70808fd3ec8770aa2d385d79938018c8ab64f68b83276.exe

C:\Users\Admin\AppData\Local\Temp\22dc46ff057d70615ed70808fd3ec8770aa2d385d79938018c8ab64f68b83276.exe
"C:\Users\Admin\AppData\Local\Temp\22dc46ff057d70615ed70808fd3ec8770aa2d385d79938018c8ab64f68b83276.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5016-0-0x0000000000400000-0x0000000002BBC000-memory.dmp

Filesize
39.7MB

Download
memory/5016-1-0x0000000000400000-0x0000000002BBC000-memory.dmp

Filesize
39.7MB

Download
memory/5016-2-0x0000000000400000-0x0000000002BBC000-memory.dmp

Filesize
39.7MB

Download