ca4100868aba772beb364773e7d530f175c1ad6bea3ed3997d90fe1ef56148be

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SAAZOD/SAAZDefaultJobExe.exe
Size 154KB
Sample260424-plnpdaat7p
SHA256 ca4100868aba772beb364773e7d530f175c1ad6bea3ed3997d90fe1ef56148be
MD5 a1a5f2bd08d87a7f6f0ae4ee5aa18efb
SHA1 592921f3a3437fab7c66b9199a9c730849f43b45
SHA512 22eed3f133a8088f2eb90b14008b5f9e85a023bf92fa1334e6882314ada0a7d0af1ed6eaacf0b959a6be387916c900ddd7eb78c2ff77851eabb44f805595c6a2
SSDEEP 1536:Hb6V/n91heFzFYwZsg6iIJLTKc5V+Ri7NcIPxKtCfEy57A:H+92FGOf3VhEc8gtC8ak
TLSH
T1D3F3AE13F9E1C4B1F55A44713AE49F7B9B7A7E34162298C3E344DA460F30AD2872A2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SAAZDefaultJobExe.exe

C:\Users\Admin\AppData\Local\Temp\SAAZOD\SAAZDefaultJobExe.exe
"C:\Users\Admin\AppData\Local\Temp\SAAZOD\SAAZDefaultJobExe.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3760-0-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/3760-2-0x0000000000400000-0x0000000000418000-memory.dmp