6973a9d6e75c3f1cbdc876df1bd11c185909dc0cc27a0d78625cc1f92696dc18

Analysis

max time kernel
12s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/04/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ldmicro.exe
Size 455KB
Sample260429-xpnsjsay8p
SHA256 6973a9d6e75c3f1cbdc876df1bd11c185909dc0cc27a0d78625cc1f92696dc18
MD5 00116d3541b7f66a8d0bb960d29465c3
SHA1 ac1fa4d6d0faf0b17908a37a149475c8ae190a7c
SHA512 a543132246798c4b44595ab3b26081d8aadcffd2d4a2303ee053f74fab0096e26d080c31820fa28e18a3393c5e425e17f9d2a497d67ed2d468e8dc163fbe499c
SSDEEP 6144:kc1RQHj0gnsuAvt4wdG7le5aKqxIGHLDRv+SEKm1Ovhf0UuHqhH:h1RQHj0gvAF4wdG7lxdxIQ9v/XH
TLSH
T1AAA48D162291C131D4A200F69DAAC7F88B69FCF5872565C376CC7DB83F366E1A23D249
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ldmicro.exe

C:\Users\Admin\AppData\Local\Temp\ldmicro.exe
"C:\Users\Admin\AppData\Local\Temp\ldmicro.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4580-0-0x00000000015AC000-0x00000000015AD000-memory.dmp

Download

memory/4580-1-0x0000000003220000-0x0000000003265000-memory.dmp