c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a

General

Target

c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
Size

136KB
MD5

ab993ad3a63a6533cc37b66106de61ea
SHA1

16ce0388a991bcd284b28aa902f2d01fa5772043
SHA256

c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a
SHA512

702b617c80668fa36a617926465c2ef00eb144ff86894db0efc4a3fc5e0f96616f95c439379ad202fe074babd6cb248ef767142ff053b8a3fe42e4cda92f2b6a
SSDEEP

1536:jOgVPwzJWY1urHjjwJDxg0trb8jJzPnGC/s+BXLE+ptlf26WLpflZf:jRwkYQPwtxZMhPGClgWjSvZf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe

pid	process
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
2372	c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe

C:\Users\Admin\AppData\Local\Temp\c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe
"C:\Users\Admin\AppData\Local\Temp\c05522cc6ba75ddb0561960718d6f00287e1eb68a42bd061d016adeb465e615a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2372-0-0x0000000000920000-0x00000000009AC000-memory.dmp

Filesize
560KB

Download
memory/2372-2-0x0000000000920000-0x00000000009AC000-memory.dmp

Filesize
560KB

Download
memory/2372-3-0x0000000000920000-0x00000000009AC000-memory.dmp

Filesize
560KB

Download
memory/2372-1-0x0000000000920000-0x00000000009AC000-memory.dmp

Filesize
560KB

Download
memory/2372-4-0x0000000000920000-0x00000000009AC000-memory.dmp

Filesize
560KB

Download
memory/2372-5-0x0000000000920000-0x00000000009AC000-memory.dmp

Filesize
560KB

Download
memory/2372-6-0x0000000000920000-0x00000000009AC000-memory.dmp

Filesize
560KB

Download
memory/2372-7-0x0000000000920000-0x00000000009AC000-memory.dmp

Filesize
560KB

Download
memory/2372-8-0x0000000000920000-0x00000000009AC000-memory.dmp

Filesize
560KB

Download
memory/2372-9-0x0000000000920000-0x00000000009AC000-memory.dmp

Filesize
560KB

Download
memory/2372-10-0x0000000000920000-0x00000000009AC000-memory.dmp

Filesize
560KB

Download
memory/2372-11-0x0000000000920000-0x00000000009AC000-memory.dmp

Filesize
560KB

Download
memory/2372-12-0x0000000000920000-0x00000000009AC000-memory.dmp

Filesize
560KB

Download
memory/2372-13-0x0000000000920000-0x00000000009AC000-memory.dmp

Filesize
560KB

Download
memory/2372-14-0x0000000000920000-0x00000000009AC000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing