aad70d416d0f6ca61facef8cabf978164dd637b12ceb1f3c59f8bb26a6be27dd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aad70d416d0f6ca61facef8cabf978164dd637b12ceb1f3c59f8bb26a6be27dd.exe
Size 2.9MB
Sample260421-a5tx6sat8x
SHA256 aad70d416d0f6ca61facef8cabf978164dd637b12ceb1f3c59f8bb26a6be27dd
MD5 b8d363ee5a03edd2d9a757772400ed41
SHA1 cdd22b48dc47e1226f794042aa7c723a2ab868b5
SHA512 cfd258c893f30df8e6f0dd85ff1ad045ac21577c2729ca7f2e225a82567c4623dbd1d376b3318edd1a578593e688c374efada884c4c8b555eb88510229885ec8
SSDEEP 49152:paCo8NGg4gJY+LUl89fdhhRW0cT8zzTkCjmIRe5JTsJ5oII4onZ2dJ7vY:pHt+8ldhhRWmzXk2O5W
TLSH
T1C7E5AF31B106C471E99211F48DBCBFAF85ACA8341B795DC3A3C42E6E99701C23B7599B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aad70d416d0f6ca61facef8cabf978164dd637b12ceb1f3c59f8bb26a6be27dd.exe

C:\Users\Admin\AppData\Local\Temp\aad70d416d0f6ca61facef8cabf978164dd637b12ceb1f3c59f8bb26a6be27dd.exe
"C:\Users\Admin\AppData\Local\Temp\aad70d416d0f6ca61facef8cabf978164dd637b12ceb1f3c59f8bb26a6be27dd.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5088-0-0x0000000000730000-0x0000000000AB0000-memory.dmp

Download

memory/5088-1-0x0000000000730000-0x0000000000AB0000-memory.dmp