df9823959d6a6340e207bd78229f962cfd8e185319feeee939b496d72f22f76f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df9823959d6a6340e207bd78229f962cfd8e185319feeee939b496d72f22f76f.exe
Size 2.6MB
Sample260421-m5cecads7p
SHA256 df9823959d6a6340e207bd78229f962cfd8e185319feeee939b496d72f22f76f
MD5 49beb266cef78af9b896ee72d5f8b4e2
SHA1 a586bfa977e1c56965ae0bdfaeba2f632c5c17c5
SHA512 248e44539066b11f9b029f0e4a7ea0d9a88cc945dca9ce56375479cf7fc1330b21af8a0ca8b094128850b1660359b69ba5d127c2fd7526d7e651385df476a9ee
SSDEEP 49152:U7ablqASLMMx49jnUVj4d4n7rAtWX8UmKwc0eW5DO9Dyfk1NU:sjx4mVU2n7Mg8UmJculGDAkfU
TLSH
T16EC5021323A04056E1F25E3586736F7876F26A918EB1D47E9BD8EDC42D239E1D623B03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df9823959d6a6340e207bd78229f962cfd8e185319feeee939b496d72f22f76f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3016	regedit.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3016	4984	df9823959d6a6340e207bd78229f962cfd8e185319feeee939b496d72f22f76f.exe	85

C:\Users\Admin\AppData\Local\Temp\df9823959d6a6340e207bd78229f962cfd8e185319feeee939b496d72f22f76f.exe
"C:\Users\Admin\AppData\Local\Temp\df9823959d6a6340e207bd78229f962cfd8e185319feeee939b496d72f22f76f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Users\Admin\AppData\Local\Temp\1.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:3016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 432B
SHA256 c06502bd63e4a46d3893cbb26eef4c470fa6c3fe545b9bb000fb395842212bfc
MD5 0d462a2ed871f78110fdf18975ffdc6d
SHA1 415df015ab39d0d9bbed184aa3e1a435f8716703
SHA512 186341fddd3f9cbb6351debbd4b822cbb75ed938f1bbab3e2199d15fa3e6ef1277eb49b88f95405ec86ade60aa3f02444d0e0b3306ac4e9a6c6b715e5806e72a
TLSH
T181E09B221FE51415B1B11AE18FF4A8335B27F9E51919C0AD10850B8C46F4F4094A13FF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4984-1-0x0000000010000000-0x000000001025B000-memory.dmp

Download

memory/4984-7-0x00000000023F0000-0x00000000023F1000-memory.dmp

Download

memory/4984-6-0x0000000000770000-0x0000000000771000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads