5243e15c2cc7a094843e36e1218596d1ab366e7b6fb61e68643bbf99350de352

Analysis

max time kernel
149s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5243e15c2cc7a094843e36e1218596d1ab366e7b6fb61e68643bbf99350de352.exe
Size 1.2MB
Sample260503-pyyecacx2l
SHA256 5243e15c2cc7a094843e36e1218596d1ab366e7b6fb61e68643bbf99350de352
MD5 fa5b98dee93b1d91d237180e139dd07d
SHA1 427121db11d91b9391b4286522c1b38599e417f7
SHA512 faadc2fd3c0763f8100bc851aec68b89d25573328fb5b83ebd2a3e834fec67d2f71d89b89ac479740a9b6f98957151b79b42ccd83c21a1b6fe1aa5fd3bc35142
SSDEEP 24576:MIlaghYqkbuMynTjDLBDlFS+udLcoRh6xOIhasqeCpV4zHJoMjbbQFb/j9tEFYEm:5bR3wfEFYKZbL
TLSH
T1C3455C29EA0611F8CA1746B0899FD77B87147EB4C036DEBBFF8DDE00B8335522855296
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5243e15c2cc7a094843e36e1218596d1ab366e7b6fb61e68643bbf99350de352.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5972	5243e15c2cc7a094843e36e1218596d1ab366e7b6fb61e68643bbf99350de352.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5972	5243e15c2cc7a094843e36e1218596d1ab366e7b6fb61e68643bbf99350de352.exe

C:\Users\Admin\AppData\Local\Temp\5243e15c2cc7a094843e36e1218596d1ab366e7b6fb61e68643bbf99350de352.exe
"C:\Users\Admin\AppData\Local\Temp\5243e15c2cc7a094843e36e1218596d1ab366e7b6fb61e68643bbf99350de352.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

launcher_config.ini

Path C:\Users\Admin\AppData\Local\Temp\launcher_config.ini
Size 357B
SHA256 512a0ec8c03ed8219765ac1817ba01cd72811794183d9706a3ddd11232a41700
MD5 0e66c6e3bc8cda19151a9aab9ad611bf
SHA1 a89ab54a60d6ee36f64404ccdd0a1891f6e7c5a1
SHA512 cf1fec865c568524a92e701fc5fa52fd7b67e5a1702b58ceebdfe9ab0b4580e592103273148df45b60ac1da21bf36a836e31bc35e0630c4906d2ad52cfd5242a
TLSH
T149E028A01D1018426075D4E8F8671BC0F09AF00F848141F4FF7446DE15AD83D1298513
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5972-38-0x00000000000B0000-0x00000000001EE000-memory.dmp

Download

memory/5972-39-0x0000000000ED0000-0x00000000014D2000-memory.dmp