d6cd868fb6f71db47b72ebabb858a20de07eb7b737626aaba640176144b3ccd8

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

da61e11a7e6f6619447869978bf36260N.exe
Size

88KB
MD5

da61e11a7e6f6619447869978bf36260
SHA1

51376e4b9b1371e26b8289b5cb0c6952bdac0b43
SHA256

d6cd868fb6f71db47b72ebabb858a20de07eb7b737626aaba640176144b3ccd8
SHA512

2a4f9e18769084facfaeb829c7c12d4b3c0f3b81e0005d3619390808d30e23f26f6ab031b5cd9f3b75a972d66c75d5e8740cbeca6379f27260ae0d02c9695cc5
SSDEEP

1536:wzQC2YFBp809MHgx1Tj1bR9ZHJ3ruWhm3gGmijE720OqI44Jh6:8T3p809MCv9ZHJ3ruWh4tjyIlbJh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da61e11a7e6f6619447869978bf36260N.exe

C:\Users\Admin\AppData\Local\Temp\da61e11a7e6f6619447869978bf36260N.exe
"C:\Users\Admin\AppData\Local\Temp\da61e11a7e6f6619447869978bf36260N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2868-0-0x0000000001000000-0x0000000001019000-memory.dmp

Filesize
100KB

Download
memory/2868-1-0x0000000001000000-0x0000000001019000-memory.dmp

Filesize
100KB

Download