790336dcb87fbaba7a7c36b9b61d6e51d202ea60d3ea9f57775275545cc17e67

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 21:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
790336dcb87fbaba7a7c36b9b61d6e51d202ea60d3ea9f57775275545cc17e67.exe
Size 459KB
Sample260507-z2ndnaaz21
SHA256 790336dcb87fbaba7a7c36b9b61d6e51d202ea60d3ea9f57775275545cc17e67
MD5 6b84a67cd7514d4ee31e87a667ef3dd1
SHA1 62f1c21c1584b723ee5997924ad11816af45678f
SHA512 6cdf5cd0248ab56b2283ca3ab848438976e266b8fe71efd581ea718aa0f1917d17b016438e4985a513cfd63188c4572f87cb683b4129ecce704845f193b4243b
SSDEEP 12288:WoolMjsP31xApRNN1vaV1OOr3tEMaqFnoUAtK:ysbN1vaVdunion
TLSH
T1A6A47B11A561C03AE5B382B28DBEA65E417CBE71072561D7F3C81D2E2FB19E27B31213
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	790336dcb87fbaba7a7c36b9b61d6e51d202ea60d3ea9f57775275545cc17e67.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2572	790336dcb87fbaba7a7c36b9b61d6e51d202ea60d3ea9f57775275545cc17e67.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2572	790336dcb87fbaba7a7c36b9b61d6e51d202ea60d3ea9f57775275545cc17e67.exe

C:\Users\Admin\AppData\Local\Temp\790336dcb87fbaba7a7c36b9b61d6e51d202ea60d3ea9f57775275545cc17e67.exe
"C:\Users\Admin\AppData\Local\Temp\790336dcb87fbaba7a7c36b9b61d6e51d202ea60d3ea9f57775275545cc17e67.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

launcher_config.ini

Path C:\Users\Admin\AppData\Local\Temp\launcher_config.ini
Size 346B
SHA256 3fea776ee19abb6b7e73942ae8fd1c457c2ea6966c9233e943e75f260184b7fe
MD5 9f5354097236a52ff892f563c3f9f7a8
SHA1 97e28889ae5465508284b449b1d74991dd96bf1f
SHA512 00974c7be7fa547158df43c69ae3f9c772bb08ea4d9c4d3974844a725b1bb22a3103ce00231bd815a9c773303da4555019cb725b154d64ae34648adc325837a9
TLSH
T1FDE02DA01E002882E076E4A8E8A71BC0E0AEB00E888141B4FF2846DE1AAC43C1698A03
MD5 SHA1 SHA512 TLSH

Submit Download