5e4f1914cabe231f57f9837558dbfef1555e030bf2f4ef4ea264f2f0e0507822

Analysis

max time kernel
100s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ddd3f6fee1b35d5902f98b21b2c50e0N.exe
Size

4KB
MD5

0ddd3f6fee1b35d5902f98b21b2c50e0
SHA1

0313022b7a08467b4c2a42a24999208876d736ae
SHA256

5e4f1914cabe231f57f9837558dbfef1555e030bf2f4ef4ea264f2f0e0507822
SHA512

becd2fa2609f72417340e468c00ff76689c9b0e989c4ea4f950b74cce537a7c62d047803800a3e0d369a28f6d4735706379f25ecf7a1946baa7696fdb3c540d1
SSDEEP

96:L0IdSLQPZARC3dCE8Y0Jw5NL6EVwHHKg2:YswdRCNCE8YPWowHHK7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ddd3f6fee1b35d5902f98b21b2c50e0N.exe

C:\Users\Admin\AppData\Local\Temp\0ddd3f6fee1b35d5902f98b21b2c50e0N.exe
"C:\Users\Admin\AppData\Local\Temp\0ddd3f6fee1b35d5902f98b21b2c50e0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3636-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3636-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download