6545b109e575cc3a60d80e7155a4a5f70d770adbe96965cb7e42a2d62ca83043

Analysis

max time kernel
149s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/03/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
meshagent32-Access.exe
Size 3.7MB
Sample260303-lllcgaby4e
SHA256 6545b109e575cc3a60d80e7155a4a5f70d770adbe96965cb7e42a2d62ca83043
MD5 067df7cf197945f6aac5413e722d5398
SHA1 c7e02cf4a5acc6a766a5d09d951b3e2e1ed5180e
SHA512 bfb7de632c0c1d29924afaaa6329456466330ff69104d40208a0f07a382d4c049809c0ba249f40042687371207ed9c864235337ab440b8b00aa003738b3ea0bb
SSDEEP 49152:hfEV3ugKeuWoAkf6bRexQlNIdwB0pJCWJ0+1NaZPwq+5bWZPaK:hfEYnnfKthWq+1jJWZPaK
TLSH
T1A906AEC3BB834471F8A736B411AB53BE9D7D69530728D4C393D428A949316D0AE3B39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	meshagent32-Access.exe

C:\Users\Admin\AppData\Local\Temp\meshagent32-Access.exe
"C:\Users\Admin\AppData\Local\Temp\meshagent32-Access.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5048-0-0x0000000002F10000-0x0000000002F92000-memory.dmp

Download