0d00d9b43ff5da4a0738ee7f0777d11423369b36e64f48081932b9165511e600

Analysis

max time kernel
118s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 05:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d00d9b43ff5da4a0738ee7f0777d11423369b36e64f48081932b9165511e600N.exe
Size

399KB
MD5

7840d34106c17963969c408d349107d0
SHA1

3bd3d1257550e2c7df99dbeef7b9bb68ec3a2c3c
SHA256

0d00d9b43ff5da4a0738ee7f0777d11423369b36e64f48081932b9165511e600
SHA512

8301df7a086bfe54cf03e1ed273acc5a49b4db02e7eefe9966603b29ed008a4110330587466e29fae0071d2e9cf603fc5d674d689cdce8d3d204676339a13803
SSDEEP

12288:FenaxxRz6DceMsVB9W5z3DWsTO0BuDD6uy:FenaxrWD1MEB9W5vWsTm6uy

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d00d9b43ff5da4a0738ee7f0777d11423369b36e64f48081932b9165511e600N.exe

C:\Users\Admin\AppData\Local\Temp\0d00d9b43ff5da4a0738ee7f0777d11423369b36e64f48081932b9165511e600N.exe
"C:\Users\Admin\AppData\Local\Temp\0d00d9b43ff5da4a0738ee7f0777d11423369b36e64f48081932b9165511e600N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UNT9E1A.tmp.exe

Filesize
2KB

MD5
84b002607a1e56dbdc57a21f2a3938e3

SHA1
6c6a05d860484eea9c8a1f8fe35ddccd67e7c672

SHA256
2bf8c9c7de4e643a7734700e0d133be0962d58c6d9505639fe0b2cf261f4151b

SHA512
4cecf9dba7cab9766183a0329146b8902a27943812f778e40cf9fa245764c4d2ea6684698aa62fdd86a99d15ca1e9b8575722d79c1a57872c3d200acbf3f5a03

Download Submit
C:\Users\Admin\AppData\Local\Temp\UNT9E1B.tmp.exe

Filesize
8KB

MD5
40e50e7cac940e3a5e96d5cb89db9807

SHA1
1121012ff6aa6e6725aa235e9d98ebe0d4a7db27

SHA256
4df2f12a786ee62657bbd0c788737e856241e028feaadfe57fc18c09a569e041

SHA512
81d2b7c996fe48a760d470aa87bd940024d6a6736c0c6877d155b7aafdb943cb44860049c8b77b191182921ed09e8cddf44cf46d4f05bf27400c1ba569c251b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\UNT9E1C.tmp.exe

Filesize
3KB

MD5
3c5d456de2e7cfbab7179ca38a7724a4

SHA1
c8ee42dcb3cbac342dedf6210b2e028c9a989d65

SHA256
4538584c350e3701ffc3d6147b6054cafa01898168371445bc12db995b9dca6c

SHA512
8ec1f5799ff6456bbd3cb4e599c755ba7885b17023ec4300caaef9df7738f231893c4a8531efca4a39a60449f03ad7ce34cff13bc4a0b7093bf1c8564182864a

Download Submit