3314312fc7f0ae1c7be8094ae935c54987de925f91c0735a3d3999e772e66cea

Analysis

user interaction
yes
max time kernel
1048s
max time network
607s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HMKHE2.0.exe
Size 629KB
Sample260511-ktb84ady4v
SHA256 3314312fc7f0ae1c7be8094ae935c54987de925f91c0735a3d3999e772e66cea
MD5 5fa5299532a36236bbec3e11858db915
SHA1 37f68353c66eec85b3e2e15e801cc951a10cd12d
SHA512 ac1a32835da97be8464eda32b438e7d2f3131d574e44bbf3ecab268805e9d059ae0fd31c6d00aa775b33425f57f2a61fe99567ad1972f2fb05b67a75946c27b9
SSDEEP 12288:bVZnCePthCS6g3dFsOPb1ffGGsNsFBGhOvl7nOvl7AD:j1CoLsNoBcMl7nMl7w
TLSH
T1EFD47D1079C2C571D2B3387009B5F632097C6C611B248AEF67E4ED7A6F744D1AA36B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HMKHE2.0.exe

C:\Users\Admin\AppData\Local\Temp\HMKHE2.0.exe
"C:\Users\Admin\AppData\Local\Temp\HMKHE2.0.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4736

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3cc 0x468
1⤵
PID:5784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4736-0-0x0000000002D00000-0x0000000002D96000-memory.dmp

Download

memory/4736-1-0x0000000002D00000-0x0000000002D96000-memory.dmp