1e898abbd6e69b99ec0c1507eda07b336b1dc82aa255c91987206e875d6bf4d7

Analysis

max time kernel
149s
max time network
127s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1e898abbd6e69b99ec0c1507eda07b336b1dc82aa255c91987206e875d6bf4d7.exe
Size 948KB
Sample260425-kbvbysb15x
SHA256 1e898abbd6e69b99ec0c1507eda07b336b1dc82aa255c91987206e875d6bf4d7
MD5 d76c2acdb1476b4ea749602016728bf6
SHA1 607f36604ecb0619afa9bb454a03b60610e13d4c
SHA512 2ca86bb8a55b1e1c0ba7d99a801376c08ea43f6c9baa75f18feaabfa3941a5a2c6f939caf5741ef81ffac8e0d819c0f35fdf9bd424774b0f63f69f000db25707
SSDEEP 12288:Qck3eoJ74fUa7z/Agm8aRzjyVuGmW7t9weEyBnPmCqu58wYjNu7DyNd/NIxQAxo7:Qck3eoJ74V7z/AP8Yz5Gn5qxIeAxohx
TLSH
T1D4259E42F98380F6D605193009B66B3A993997470B21CBC797A8DE7D6D33691FE3324E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e898abbd6e69b99ec0c1507eda07b336b1dc82aa255c91987206e875d6bf4d7.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5004	1e898abbd6e69b99ec0c1507eda07b336b1dc82aa255c91987206e875d6bf4d7.exe
5004	1e898abbd6e69b99ec0c1507eda07b336b1dc82aa255c91987206e875d6bf4d7.exe

C:\Users\Admin\AppData\Local\Temp\1e898abbd6e69b99ec0c1507eda07b336b1dc82aa255c91987206e875d6bf4d7.exe
"C:\Users\Admin\AppData\Local\Temp\1e898abbd6e69b99ec0c1507eda07b336b1dc82aa255c91987206e875d6bf4d7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5004-0-0x0000000000BF0000-0x0000000000CCF000-memory.dmp

Download

memory/5004-2-0x0000000000BF0000-0x0000000000CCF000-memory.dmp