409bd7d0416ebf63733cd6f8d0f05e86e81c002fabbf4cadc4270927aee8a073

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

409bd7d0416ebf63733cd6f8d0f05e86e81c002fabbf4cadc4270927aee8a073.exe
Size

500KB
MD5

d4867290169294c423ebd479338c79c5
SHA1

7985988b74e66ff2186ea94d095196b83846fce2
SHA256

409bd7d0416ebf63733cd6f8d0f05e86e81c002fabbf4cadc4270927aee8a073
SHA512

f8d6311b4efbebd7dfc9f7913129db56034fc2965458e663eac7b4e5928c8cec6fd27e89aba2e0c2f02eb5ed679eee1e8d8e6a4ff60000ec8a38eb178dc86036
SSDEEP

12288:7LHg6KLGIA58Z1qcIwAMs4aeWDemPU/r5rwZU3WmW3cdlxPiRKI9nXnr8GsSWRE:7LE1qbwACmPYxFWmWgxG8GsPE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	409bd7d0416ebf63733cd6f8d0f05e86e81c002fabbf4cadc4270927aee8a073.exe

C:\Users\Admin\AppData\Local\Temp\409bd7d0416ebf63733cd6f8d0f05e86e81c002fabbf4cadc4270927aee8a073.exe
"C:\Users\Admin\AppData\Local\Temp\409bd7d0416ebf63733cd6f8d0f05e86e81c002fabbf4cadc4270927aee8a073.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-0-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/368-1-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download