d0b647527c7afd9b3b4b713bd3c861b99127813da55f94361241f87477223fd2

Analysis

max time kernel
96s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2025, 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0b647527c7afd9b3b4b713bd3c861b99127813da55f94361241f87477223fd2.exe
Size

1.2MB
MD5

057968cbef633fc317e93f3d276d86cc
SHA1

3476318ac3fc12832a50161f3cf68105aabffeb7
SHA256

d0b647527c7afd9b3b4b713bd3c861b99127813da55f94361241f87477223fd2
SHA512

3c0d967fc8a6c5607905df5daee3acca0fd767a617accec36559c052e0f2354f2ce0b5ef7f6fe2c5b3630a86027eb89188809a0998ea9d1c4894d69042c9d960
SSDEEP

12288:Ox42+TG4hYG64iHpSk38cr/j8dOH7cqMXM5IhXgLVscovlitSl9zak6+5d/uWLV:OaIwk38eod2NxGadovlQSlARu1VYST

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d0b647527c7afd9b3b4b713bd3c861b99127813da55f94361241f87477223fd2.exe

C:\Users\Admin\AppData\Local\Temp\d0b647527c7afd9b3b4b713bd3c861b99127813da55f94361241f87477223fd2.exe
"C:\Users\Admin\AppData\Local\Temp\d0b647527c7afd9b3b4b713bd3c861b99127813da55f94361241f87477223fd2.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-0-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download
memory/1216-1-0x0000000000400000-0x000000000053C000-memory.dmp

Filesize
1.2MB

Download