20ece3a0b28dc0d0afed599a9df11ad87b69e6acfbc2ffe3d950fb591d19db82

Analysis

max time kernel
90s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20ece3a0b28dc0d0afed599a9df11ad87b69e6acfbc2ffe3d950fb591d19db82N.exe
Size

468KB
MD5

aa7f409d943aa99b431d8a710ab47f20
SHA1

148e78ab5d91d062ea3fad5c17d50979d0d57385
SHA256

20ece3a0b28dc0d0afed599a9df11ad87b69e6acfbc2ffe3d950fb591d19db82
SHA512

0cfd8d221c240c9e59964c6176fcbf06db5ea6eaa2effb7a3da22f8171fd2cdf0cf71b07b2dc595b29347eb7fb5e95d684fd03991acd4a6e17fdff393fc0955e
SSDEEP

3072:tGAwog5dP08U1bY0Pzijix8/9Uhjt4pCndHeZVIPpqC3wlbNsElY:tG7om5U13Pejix5EBupqwIbNs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20ece3a0b28dc0d0afed599a9df11ad87b69e6acfbc2ffe3d950fb591d19db82N.exe

C:\Users\Admin\AppData\Local\Temp\20ece3a0b28dc0d0afed599a9df11ad87b69e6acfbc2ffe3d950fb591d19db82N.exe
"C:\Users\Admin\AppData\Local\Temp\20ece3a0b28dc0d0afed599a9df11ad87b69e6acfbc2ffe3d950fb591d19db82N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3988-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3988-1-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download