353df4f186c06a626373b0978d15ec6357510fd0d4ac54b63217b37142ab52d3

Analysis

max time kernel
898s
max time network
503s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/02/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
The-MALWARE-Repo-master/Trojan/FlashKiller.exe
Size 4KB
Sample260222-cdtt7sb16e
SHA256 353df4f186c06a626373b0978d15ec6357510fd0d4ac54b63217b37142ab52d3
MD5 331973644859575a72f7b08ba0447f2a
SHA1 869a4f0c48ed46b8fe107c0368d5206bc8b2efb5
SHA512 402662eb4d47af234b3e5fbba10c6d77bdfdb9ff8ecfdd9d204f0264b64ea97fc3b5c54469f537173a26c72b3733550854749649d649bc0153c8fe3faacc50a1
TLSH
T1C581546387400FB2DC541E7B32F314A565FB493067F53A001EC0844CD10BA180D7CEE4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5052	4956	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FlashKiller.exe

C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\FlashKiller.exe
"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\FlashKiller.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 248
  2⤵
  - Program crash
  PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4956 -ip 4956
1⤵
PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4956-0-0x0000000000400000-0x0000000000404000-memory.dmp

Download