9ec85d0217099d5847a894b0f6bbaf8ca010e6602fff97f89d80ff73257ff90a

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ec85d0217099d5847a894b0f6bbaf8ca010e6602fff97f89d80ff73257ff90aN.exe
Size

4KB
MD5

7b6534dc01505d4497bb5eb0c6bd38d0
SHA1

d8da86ea6402ea2a49c6a8665e2706cf1454b6a0
SHA256

9ec85d0217099d5847a894b0f6bbaf8ca010e6602fff97f89d80ff73257ff90a
SHA512

b1a5e8ad9c4f9aa4a33c20c3e41f290d1ca25e4854561a6234e290eb70a5e7746826e16bcbb03eb88f5d2948298599b2c342bd467429cd4113afa0f091c33500
SSDEEP

96:LdWIdSLQPZARC3dCE8Y0Jw5NL6EVwHHKg2:oswdRCNCE8YPWowHHK7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ec85d0217099d5847a894b0f6bbaf8ca010e6602fff97f89d80ff73257ff90aN.exe

C:\Users\Admin\AppData\Local\Temp\9ec85d0217099d5847a894b0f6bbaf8ca010e6602fff97f89d80ff73257ff90aN.exe
"C:\Users\Admin\AppData\Local\Temp\9ec85d0217099d5847a894b0f6bbaf8ca010e6602fff97f89d80ff73257ff90aN.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1584-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1584-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download