ebce13c84f3a8bee27e304accc2a0fa3cd0c0bb1d56f0501024fde9eb1cee375

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$R0.dll
Size 32KB
Sample260422-ppb5rabw3x
SHA256 ebce13c84f3a8bee27e304accc2a0fa3cd0c0bb1d56f0501024fde9eb1cee375
MD5 1ed933a684b49120a2c42d5b4f366d0d
SHA1 2992d10c3c0ec10e51d7c90ed4425cb83c763d06
SHA512 503bf8e04af921cdcc5eb6a1051bd5ba173c26f7f5b5ddfc2d77a4346ad238f9366127de4ade6bf1c08666f79f23046e06a0100d40ea98c67e54bf25d6d7404d
SSDEEP 768:h/Bod79KZGU7L5oF6vPskQnLMbAgewd9j1lDibLfNobqu8:h/Wd7Tk7u4bAgewdp1l2dobP8
TLSH
T1D8E25D06FF1168B1DED34CF469D9DB7B86B135328D164AA2FF58C3487422B636904E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5768 wrote to memory of 1364	5768	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$R0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5768
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$R0.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-0-0x0000000001200000-0x00000000012BF000-memory.dmp

Download

memory/5768-1-0x0000000000B50000-0x0000000000C7A000-memory.dmp