02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 22:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945.exe
Size 3.9MB
Sample260416-2jth3act4p
SHA256 02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945
MD5 fb41928ec1132e8def2fa16bfb66c28d
SHA1 187a4e1cd3ef940f319fd99bcb4e4af4a96400c2
SHA512 a6b8ede4355d986790b1249e62f46c2a592ba563887e3eaaf506b996bf1351f8cdba303d1545003b29735d7756e7d34a9a91d686415ac8dc75f8c7a0bede5ca9
SSDEEP 98304:F5lWK+tw2kRMJ1QrROwLmN7bal7fnnwnrViDcRB4k:F5lWK+twzx0e7P8ZiDcRr
TLSH
T139167C2275144432D69142B29F0DEBBDDBBC6F70076240D37284BAAC6E76DC21736E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2716	02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945.exe
2716	02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945.exe
2716	02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945.exe
2716	02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2716	02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945.exe
2716	02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945.exe
2716	02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945.exe
2716	02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945.exe
2716	02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945.exe
2716	02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945.exe
2716	02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945.exe
2716	02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945.exe

C:\Users\Admin\AppData\Local\Temp\02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945.exe
"C:\Users\Admin\AppData\Local\Temp\02d58c6dcac046b53107007f1f774a10f077262dd11acc32e58b88b3efcd5945.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PassedConditions.ini

Path C:\Users\Admin\AppData\Local\Temp\setting\PassedConditions.ini
Size 122B
SHA256 506c52ba6201431cca9586ee737eaa12c7002e56b402440ba44ede1ef8632a66
MD5 1374f8f7e1cd8cc24fd8c7da88ce79ce
SHA1 5e83372d60aab218b3e13de38bf3e1a0da66f00e
SHA512 84100881406e3db540fe918ace4738130ef30b67861f3be661999e93530bccc662eec7bbc79b6d3ada5ffe69666f3524cd2266d0a7cf21895e4b270d65555599
TLSH
T191B0924736408DD3547BE0E4E820825262A6BB409A0214A01E31320B2ADCC3FBD00A72
MD5 SHA1 SHA512 TLSH

Submit Download

system.ini

Path C:\Users\Admin\AppData\Local\Temp\setting\system.ini
Size 41B
SHA256 bf89c32ffc4c446756bcb9b16fb980f7ddaff67824298c9983855d09d05deccc
MD5 dd7a5b1b39f21bbe976a18695a83f9cf
SHA1 c5c236636e0f7acc15beb4d052e88ad3c9865ac5
SHA512 22216213ccc3f96f5730ea99377e8d95b192af03084a28689c7131d9ece06b1fd7484ed3638345ce7c5841591b797d7410302a50639561eaef57568032224803
MD5 SHA1 SHA512

Submit Download

system.ini

Path C:\Users\Admin\AppData\Local\Temp\setting\system.ini
Size 407B
SHA256 f9358d7da24a1c1feb3d8d961aef03f039b5dc2b49a043429d75b6c678e5831d
MD5 f348caf5e793b969ef54467c6eed9fe9
SHA1 842c0a066a00e9fcd05a82977a7f18a14c20e292
SHA512 e8f4331280f2b78eb97bc60a052384ca49556ad4e8a55ec25f1a5b1dfcc5a8ee13484e729276cda539f51330a29a4a3cea3216206c0e9201f68828baed408c87
TLSH
T16FE09B0ED152AE5CB9E8403795084DD2D1C38C9447355D56C1FE1FBB7DD9C260CD7051
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2716-77-0x00000000015C0000-0x0000000001617000-memory.dmp

Download