040758970d4945582cab500a5cd1127b032875007fe19ef2839bb2a171e3b9ca

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

040758970d4945582cab500a5cd1127b032875007fe19ef2839bb2a171e3b9caN.exe
Size

468KB
MD5

3584bab2fcb6f23964e2785f221dcaa0
SHA1

031da0e19fc36f6cecc68da20bec6d503f0697c2
SHA256

040758970d4945582cab500a5cd1127b032875007fe19ef2839bb2a171e3b9ca
SHA512

fa25d4f9fd62f6bafac8acb63dddb008b4bf144cf1ef3d537d82ae1c538cc8fa406408673264da4929bb9a59a2de989e5aae71bdd9fe376f99471e3f54681f75
SSDEEP

3072:a35Sogudz2Y8UnIYHPz5Ecf54fhjWLp8CtHevVpFMjoLrqgNIXXH:a3ooNqUnNP1Ecf31CdMji+gNI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	040758970d4945582cab500a5cd1127b032875007fe19ef2839bb2a171e3b9caN.exe

C:\Users\Admin\AppData\Local\Temp\040758970d4945582cab500a5cd1127b032875007fe19ef2839bb2a171e3b9caN.exe
"C:\Users\Admin\AppData\Local\Temp\040758970d4945582cab500a5cd1127b032875007fe19ef2839bb2a171e3b9caN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4844-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4844-1-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download