98ba0d26044bd6c4239c1d17e678bc1159ed8fa5b9b08b06a7c452f602abbce8

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_98ba0d26044bd6c4239c1d17e678bc1159ed8fa5b9b08b06a7c452f602abbce8.exe
Size 18KB
Sample260422-drkdcsf16k
SHA256 98ba0d26044bd6c4239c1d17e678bc1159ed8fa5b9b08b06a7c452f602abbce8
MD5 35b8858f1fb72e09aca7c9e788bffb27
SHA1 655d6d69846fa053fe1f4e1af85fe7eae578a937
SHA512 258b9fede3b1388db546c66daccd4f8dc08093e4901fa0c80053aa1245d7380423ea907757ddf0f9676ee84ef72b64ed596eb48900fb5172724f37a181abd68a
SSDEEP 384:XI7MVGASM1KwngSZb7u9NHu/gRhav8U9cs:kQ8Ub69Jha0Ur
TLSH
T151824B0FB942421AD0D100749636867BDAB998B637D814EBFBD08AED1A686D1FC3315F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_98ba0d26044bd6c4239c1d17e678bc1159ed8fa5b9b08b06a7c452f602abbce8.exe

C:\Users\Admin\AppData\Local\Temp\_98ba0d26044bd6c4239c1d17e678bc1159ed8fa5b9b08b06a7c452f602abbce8.exe
"C:\Users\Admin\AppData\Local\Temp\_98ba0d26044bd6c4239c1d17e678bc1159ed8fa5b9b08b06a7c452f602abbce8.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/312-0-0x00000000018E0000-0x00000000018F9000-memory.dmp

Download

memory/312-2-0x00000000018E0000-0x00000000018F9000-memory.dmp