5ec174af8a18a5516b8a6e11d8a27481d70df14d1edb67c48b5458ff44df9146

Analysis

max time kernel
101s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2025, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XPFix.exe.bin.exe
Size 286KB
Sample250601-e3be9sbk81
SHA256 5ec174af8a18a5516b8a6e11d8a27481d70df14d1edb67c48b5458ff44df9146
MD5 810d42177538ad5ca18d4dd597c00658
SHA1 7374bbe63c44de9536c22cdc111894c6d4929eb3
SHA512 233cdbaa1658719e9e44869930aef8ed09a17bd1e227c43785ce1b4298fd9f767818b75888db9cb5184a134a0babedd32cc0788059c251a1dff3f6aa27ebd30d
SSDEEP 6144:WEDFuBN6zANskE9qgfyMEvt93L2kx3W71+KL:WiuB4fyzvtFt3WFL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XPFix.exe.bin.exe

C:\Users\Admin\AppData\Local\Temp\XPFix.exe.bin.exe
"C:\Users\Admin\AppData\Local\Temp\XPFix.exe.bin.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4768-0-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Download