17bfc59fd3df6e1543554b3034da8cb463f1fb46d19f34e688e85ad7e6da2357

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41641d1ed44b1a0c58d6614347c7cdc0N.exe
Size

468KB
MD5

41641d1ed44b1a0c58d6614347c7cdc0
SHA1

ec7a52f3d01254a304e14f5fc41f2eaa33895ec4
SHA256

17bfc59fd3df6e1543554b3034da8cb463f1fb46d19f34e688e85ad7e6da2357
SHA512

1e5ac4303edfcb65007d51ee2a3000a1f870d3769c27a00739838a11d38ff41c6be7c6c1bd80bbddb13b12cd6e58c5190a52701e21374f41ba40dfff8e0a1ff9
SSDEEP

3072:fbo9ogLaTq8U2bYXYz5jff5ECBNcdprnmHevVpDI9P+DUxrSelu:fbGo7TU2EY1jffUr97I92IxrS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41641d1ed44b1a0c58d6614347c7cdc0N.exe

C:\Users\Admin\AppData\Local\Temp\41641d1ed44b1a0c58d6614347c7cdc0N.exe
"C:\Users\Admin\AppData\Local\Temp\41641d1ed44b1a0c58d6614347c7cdc0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1268-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1268-1-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download