f887b6365870937373b205c209b668b249219314721a53a7f0ede05e9b1a8d16

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f887b6365870937373b205c209b668b249219314721a53a7f0ede05e9b1a8d16.exe
Size 624KB
Sample260508-jm45vset9y
SHA256 f887b6365870937373b205c209b668b249219314721a53a7f0ede05e9b1a8d16
MD5 a52dba1b2728a4fe1245e5d69c4a6c88
SHA1 aa46ec497899dbf6a9990fd3575a1c768e242e0d
SHA512 13097198b8db9e83a63370dcf92b2e5a31826324e6809ead0c4b3cbe42d3b843d2e829f6b8de2e4b8677978caa10e99a10d385a7d9827ac06c3eb808824cb432
SSDEEP 12288:cdA6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:c19Sb1E2ZamlZkBMB28kn
TLSH
T1F5D423137388C63ACA4542757CB99BB79679DF386F2146C793849E1B0F321E34C3296A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f887b6365870937373b205c209b668b249219314721a53a7f0ede05e9b1a8d16.exe

C:\Users\Admin\AppData\Local\Temp\f887b6365870937373b205c209b668b249219314721a53a7f0ede05e9b1a8d16.exe
"C:\Users\Admin\AppData\Local\Temp\f887b6365870937373b205c209b668b249219314721a53a7f0ede05e9b1a8d16.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4408-0-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/4408-1-0x0000000000400000-0x00000000004A0000-memory.dmp