a4a4bfd73d3d18d53be964ecff170e25b0567f646674b4fc379918b59acea696

Analysis

max time kernel
106s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0839776a009559df7e3e9fe0a60ad10N.exe
Size

468KB
MD5

f0839776a009559df7e3e9fe0a60ad10
SHA1

45ecdb7bcb83b0027f98fd934e7bd51fb93d420f
SHA256

a4a4bfd73d3d18d53be964ecff170e25b0567f646674b4fc379918b59acea696
SHA512

34795b27b300d17e9e12a1f98e61f5b41f770503d9a1e6b77bd6150043204e24901c38af206532bbb61e433a3b3dc10f0e614293ecc5e1ba97c4f4d98d8f5d09
SSDEEP

3072:sT+rogldjG802bYk8zhjfNr/y/ujV3pjmDHevVFZdQ534Aw6K/lz:sT6oaH0238djfNpZbBdQB9w6K

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0839776a009559df7e3e9fe0a60ad10N.exe

C:\Users\Admin\AppData\Local\Temp\f0839776a009559df7e3e9fe0a60ad10N.exe
"C:\Users\Admin\AppData\Local\Temp\f0839776a009559df7e3e9fe0a60ad10N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/400-1-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download