dae456f36263fa7dcf6a4217d9f1ede8e46d5408c63f2bd49a8dc85d95a263dd

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dae456f36263fa7dcf6a4217d9f1ede8e46d5408c63f2bd49a8dc85d95a263dd.exe
Size

2.2MB
MD5

3cbbdde564427795fab90fdddb4ecf05
SHA1

83863a0e3e256e4b03e6d22f49d2371e342f34e2
SHA256

dae456f36263fa7dcf6a4217d9f1ede8e46d5408c63f2bd49a8dc85d95a263dd
SHA512

960c30e38478bcca903dce6c772f0d022596c6ecd669d77f6846f68638a1003a59c990e0de36aa5acefe94fdc72dc286ce063e38a3602dd67d95f5865d989d2d
SSDEEP

24576:Cmd/rw97o4zo2hM3Mr7KcxHxNhW1DdcRA4/L69B83/g8WW+3vh8bWXmMmmQfB2m0:LETRlr7KcJQEBo8WWaZTXoL2mcSde7w8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dae456f36263fa7dcf6a4217d9f1ede8e46d5408c63f2bd49a8dc85d95a263dd.exe

C:\Users\Admin\AppData\Local\Temp\dae456f36263fa7dcf6a4217d9f1ede8e46d5408c63f2bd49a8dc85d95a263dd.exe
"C:\Users\Admin\AppData\Local\Temp\dae456f36263fa7dcf6a4217d9f1ede8e46d5408c63f2bd49a8dc85d95a263dd.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4936-0-0x0000000000400000-0x000000000142E000-memory.dmp

Filesize
16.2MB

Download
memory/4936-1-0x0000000000400000-0x000000000142E000-memory.dmp

Filesize
16.2MB

Download