d3fc07b8625ff669fa8d3f0ca18937b4516a0ac3be19258af42bfda55709ef73

Analysis

max time kernel
149s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3fc07b8625ff669fa8d3f0ca18937b4516a0ac3be19258af42bfda55709ef73.exe
Size 321KB
Sample260423-1stdzsat9x
SHA256 d3fc07b8625ff669fa8d3f0ca18937b4516a0ac3be19258af42bfda55709ef73
MD5 e9e2f62bf80268126f9bc3e25cd14c9f
SHA1 b7ad8ed23e0526dad3beca09f5c0e6dbb91353fc
SHA512 3841e10d4c33df3d3217bdcc586de6f7a039aa5fc66387c64eb19ac121c905d58714a26a3afcd63deabf45bf59df588635b79242199187ffc5dde79f99af06a9
SSDEEP 6144:HEsZ5iexbevn8E2batfDX4QVSRi5HgCL5LqMIKGQyy0tR/:HEii38EL7VSg5HgCFLqyGQyL
TLSH
T189644B1137E0C436C2A235324966E77566BEBD319E35834F27D53B7E9E30291AA2834F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3fc07b8625ff669fa8d3f0ca18937b4516a0ac3be19258af42bfda55709ef73.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4320	d3fc07b8625ff669fa8d3f0ca18937b4516a0ac3be19258af42bfda55709ef73.exe
4320	d3fc07b8625ff669fa8d3f0ca18937b4516a0ac3be19258af42bfda55709ef73.exe

C:\Users\Admin\AppData\Local\Temp\d3fc07b8625ff669fa8d3f0ca18937b4516a0ac3be19258af42bfda55709ef73.exe
"C:\Users\Admin\AppData\Local\Temp\d3fc07b8625ff669fa8d3f0ca18937b4516a0ac3be19258af42bfda55709ef73.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4320-0-0x0000000000C20000-0x0000000000CFF000-memory.dmp

Download