1bd13a28f62855a85170033ee25f73c387b512b0042be9314981887074393d0f

Analysis

max time kernel
6s
max time network
1s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/03/2025, 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bd13a28f62855a85170033ee25f73c387b512b0042be9314981887074393d0f.exe
Size

272KB
MD5

ddd9a73f6b017c6839674d5e6f665c3f
SHA1

cb3f1debb913d6cafab38102c9f35b6450c3a3ac
SHA256

1bd13a28f62855a85170033ee25f73c387b512b0042be9314981887074393d0f
SHA512

41ef3b93154675266266dde5bbf579f54931ed3295ccaf1f2817201dbab3f07c1632f3c57a21f8d1bc9cdd02eba2f05735c946e6a4e17096e5ac7040b2cb0aa6
SSDEEP

3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8sdTo:WFzDqa86hV6uRRqX1evPlwAEdM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1bd13a28f62855a85170033ee25f73c387b512b0042be9314981887074393d0f.exe

C:\Users\Admin\AppData\Local\Temp\1bd13a28f62855a85170033ee25f73c387b512b0042be9314981887074393d0f.exe
"C:\Users\Admin\AppData\Local\Temp\1bd13a28f62855a85170033ee25f73c387b512b0042be9314981887074393d0f.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2672-0-0x00000000748AE000-0x00000000748AF000-memory.dmp

Filesize
4KB

Download
memory/2672-1-0x0000000000AE0000-0x0000000000B26000-memory.dmp

Filesize
280KB

Download
memory/2672-2-0x0000000000790000-0x000000000079A000-memory.dmp

Filesize
40KB

Download
memory/2672-3-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download