c8088efc6e7c73b7893203cc208fd942c2b239030a5b07746c0d2a8d3303fcb4

Analysis

max time kernel
110s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8088efc6e7c73b7893203cc208fd942c2b239030a5b07746c0d2a8d3303fcb4N.exe
Size

156KB
MD5

f02c9908b96405b93a3ab78f708cb7e0
SHA1

41ce175e10cddca1139cb59b12275cb759c77fcb
SHA256

c8088efc6e7c73b7893203cc208fd942c2b239030a5b07746c0d2a8d3303fcb4
SHA512

30c1b937ad3e832ce6462f4ca956639ec9688d6ad0b15c4eaf0c1bdbe54eadafa210242ceae6961bc24b0c8a1ae9f69a6238200e266f8dfb1eff7c05b4e27f49
SSDEEP

3072:1s3o8A4M3riN6MhGkgS3PL67n5OkhBOPC/+/FnncrU:1DeM7iNEkgi81ECgJn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8088efc6e7c73b7893203cc208fd942c2b239030a5b07746c0d2a8d3303fcb4N.exe

C:\Users\Admin\AppData\Local\Temp\c8088efc6e7c73b7893203cc208fd942c2b239030a5b07746c0d2a8d3303fcb4N.exe
"C:\Users\Admin\AppData\Local\Temp\c8088efc6e7c73b7893203cc208fd942c2b239030a5b07746c0d2a8d3303fcb4N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1860-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1860-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1860-11-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download