03ef1284a4fb1ff14d7d3215672e4d989235a69cabcd97b70cc1d0aa3b1aca7a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/05/2026, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
03ef1284a4fb1ff14d7d3215672e4d989235a69cabcd97b70cc1d0aa3b1aca7a.exe
Size 282KB
Sample260510-snbdlses2l
SHA256 03ef1284a4fb1ff14d7d3215672e4d989235a69cabcd97b70cc1d0aa3b1aca7a
MD5 bdc676d2ce4bc98f1aba65ec895bb538
SHA1 cef83109357bb1047bcf0477940d035c55860485
SHA512 72f093b2f4e57309cb9af8af9935ab456a43931b7576a8c6b00980120d6c72e1b6152f483736b1005cfacff1ee5b62b4274df0994ebd962eada27127e79d568e
SSDEEP 3072:mmebUWcCyoV26qlWD+NbPjBBO3VVNizxM8h/6SZDRH2Ht78+axv7Y1+DRh94FdQK:mumyoDqlWDSdATSZEH95145Qw/fhM
TLSH
T177547E12B6D0C071E57302331DB6A725567DFC719E3ADA4F63984B0EDE30992AA36363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03ef1284a4fb1ff14d7d3215672e4d989235a69cabcd97b70cc1d0aa3b1aca7a.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5020	03ef1284a4fb1ff14d7d3215672e4d989235a69cabcd97b70cc1d0aa3b1aca7a.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5020	03ef1284a4fb1ff14d7d3215672e4d989235a69cabcd97b70cc1d0aa3b1aca7a.exe

C:\Users\Admin\AppData\Local\Temp\03ef1284a4fb1ff14d7d3215672e4d989235a69cabcd97b70cc1d0aa3b1aca7a.exe
"C:\Users\Admin\AppData\Local\Temp\03ef1284a4fb1ff14d7d3215672e4d989235a69cabcd97b70cc1d0aa3b1aca7a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

launcher_config.ini

Path C:\Users\Admin\AppData\Local\Temp\launcher_config.ini
Size 346B
SHA256 67c0a3ef1321c6e54b85d84e47d228491c020cb926ff37cbf49a21393ac1ecfa
MD5 6fea9b7c4b80cf9edc77d8d130bdf65a
SHA1 3bdd912331326ad7907b3d3528aa97388ba8db7f
SHA512 3ae804ef92bd6711002d52516381d87c80673945ac7180ad55229c5c871525c829f26d28d6be89d98f39d205bcb8b59c7f3c642c863de064fef5a8b654ec23a9
TLSH
T138E02D901E002843E076E4A8E8AB1BC0E0EAB00F88814074FF2846DE1AAC43C16D8A03
MD5 SHA1 SHA512 TLSH

Submit Download