c59b51d15b5965f27db4c5bbd21793ad6b492c8c751836ba8bd43829d791146e

Analysis

max time kernel
91s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 12:09

Target

ncat.exe
Size

355KB
MD5

4f6b1c5a41f7e9d183a7dd3ace65812e
SHA1

c08a5e5c59f39522939284ee8743ff55967da76a
SHA256

a3071223a56a18c9fb913696487f69d1ea2633176412446d4b7eecc82d33c262
SHA512

25c7a3f16b001144cc8fdc5c9014cdfe33352bd76c116c3e1b7e3238668ae0b284fc641b96aee92d07dc9a25fa9b016e441db96c07f2426e09b0ec9b8d2443cf
SSDEEP

6144:ptY7W0+Pb/+japAtAGZ8+cQm+hSD5I55HinqrphrBEU3VEBIPZ/5owu8zsX4ROVq:ptF00/+japAtAGq+RSFO4n4NBEU3V7PJ

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

ncat.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ncat.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ncat.exe

C:\Users\Admin\AppData\Local\Temp\ncat.exe
"C:\Users\Admin\AppData\Local\Temp\ncat.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4156

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance