e460f75a2f6597301150c12504b6acee43a3e1819b7464230bc45039faab5c97

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dfsdf/dede/php.exe
Size 28KB
Sample260420-apy7ysat5y
SHA256 e460f75a2f6597301150c12504b6acee43a3e1819b7464230bc45039faab5c97
MD5 86d68e31618a3916896a1327deabc5e9
SHA1 62adc0df2428d2b6f9d97d1a7fd530e2c8510ee7
SHA512 e4c12def9e672d00768f1ca6f56e89dfc9801c4e7fbb7b3336c99860e5e2b749c073db13c148c8efa5dd857202df9cb5d0e8db38dd07b361622c0e864a5b440d
SSDEEP 384:6SWJ7AGBk3vG6L6kpP2906+FBnezZGAGyNOtKD4xA:6SA+3v7WkpP265iBufA
TLSH
T16BD2080B06651475D3E4813132E6A677AA37B5430938EA3BBDCCCEC85F15960DDB2A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	php.exe

C:\Users\Admin\AppData\Local\Temp\dfsdf\dede\php.exe
"C:\Users\Admin\AppData\Local\Temp\dfsdf\dede\php.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4816-0-0x00000000025E0000-0x0000000002780000-memory.dmp

Download