2114ef313f5d02d82c2c3d3a4e7b25e27b1c2458d1e4577fe9581932f7beb817

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2114ef313f5d02d82c2c3d3a4e7b25e27b1c2458d1e4577fe9581932f7beb817.exe
Size

1.3MB
MD5

e665f090dc37cabef38f2b8526cc695c
SHA1

18b16f40d602be1e2f840cc69279bf84bd17e27d
SHA256

2114ef313f5d02d82c2c3d3a4e7b25e27b1c2458d1e4577fe9581932f7beb817
SHA512

f62030759cba1fdfbc18f98d562d50f1d2aafa4d45d401f71ed03b62019923c06bc2521c1f3849b4437f89d645a8124d9f2fbe03e42200c8d64edc77a9b6cd2b
SSDEEP

24576:fIXgCWSpRyndSJVDsVu5unzqWvX13atr0zAiX90z/F0jsFB3SQkM:+WSjaSJlsQuzqW/13aB0zj0yjoB2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2114ef313f5d02d82c2c3d3a4e7b25e27b1c2458d1e4577fe9581932f7beb817.exe

C:\Users\Admin\AppData\Local\Temp\2114ef313f5d02d82c2c3d3a4e7b25e27b1c2458d1e4577fe9581932f7beb817.exe
"C:\Users\Admin\AppData\Local\Temp\2114ef313f5d02d82c2c3d3a4e7b25e27b1c2458d1e4577fe9581932f7beb817.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4188-0-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/4188-2-0x00000000022B0000-0x0000000002317000-memory.dmp

Filesize
412KB

Download
memory/4188-8-0x00000000022B0000-0x0000000002317000-memory.dmp

Filesize
412KB

Download
memory/4188-12-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download