ea3db44871c5ffbe8ba090f4edf7ee9d46f57e86c2ce2716e19e9fb0b3604983

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea3db44871c5ffbe8ba090f4edf7ee9d46f57e86c2ce2716e19e9fb0b3604983.exe
Size 1.3MB
Sample241109-2vpdgswrcp
SHA256 ea3db44871c5ffbe8ba090f4edf7ee9d46f57e86c2ce2716e19e9fb0b3604983
MD5 c60ae92158ee2eae32a445ddad3c1b51
SHA1 4bd118bdef934611a35ae4aa2543aaf0e043318e
SHA512 dc6eb3fd949349e2f3807ffc2debfe3cae101cc0fd6a7ccc1402a422820c216bb125838e70a1744cac2d3f868d2a69d53569604624fd3bc3d92d48ea606ad6c3
SSDEEP 24576:6IXgCWSpRy4dSJVDsVu5unzqWvX1lt/sBlDqgZQd6XKtiMJYiPU:tWSjLSJlsQuzqW/1H/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea3db44871c5ffbe8ba090f4edf7ee9d46f57e86c2ce2716e19e9fb0b3604983.exe

C:\Users\Admin\AppData\Local\Temp\ea3db44871c5ffbe8ba090f4edf7ee9d46f57e86c2ce2716e19e9fb0b3604983.exe
"C:\Users\Admin\AppData\Local\Temp\ea3db44871c5ffbe8ba090f4edf7ee9d46f57e86c2ce2716e19e9fb0b3604983.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4960-0-0x0000000000400000-0x0000000000546000-memory.dmp

Download

memory/4960-1-0x0000000000400000-0x0000000000546000-memory.dmp