0af52a52c308682881795fbbcac771f76c4d9b454f1aa38f7516e5e04753693a

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 12:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Abril2026.exe
Size 514KB
Sample260511-pqrltsds5p
SHA256 0af52a52c308682881795fbbcac771f76c4d9b454f1aa38f7516e5e04753693a
MD5 ba9b1bad00f63c55323cb7ebbb6e6a05
SHA1 8380456e53b4d06491bfc877608c713e76795e70
SHA512 4fbbd11d5f5b82faac647dbf5d1ead87ae48e7eed229bb4f78af9bcd39a6da178a54d51307fb2eda07c4834ee88c985537ca24c1b2c5244679288f0b2174dde1
SSDEEP 12288:fg2cpfSUy6oFGNfZvCcXmw0z38qsPZ0W1:fgdfty6oFQfNwz38JZt
TLSH
T1F4B4BF01B6E2C172D57660300936E735DEBDBD2018369D7BA3DA0D57FE30290A739AB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abril2026.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
908	Abril2026.exe

C:\Users\Admin\AppData\Local\Temp\Abril2026.exe
"C:\Users\Admin\AppData\Local\Temp\Abril2026.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\store\logs.dat
Size 184B
SHA256 c4d8cafeb1b8ced7acd0c8a36ef5527c4529bf00d02c984c1eada9e24e872a13
MD5 2eb6493b046a35af6a77a0261699f57f
SHA1 f4b9527d6d3c9a0331a540b2b0f4531c383650c9
SHA512 4845219352d48421da2e63047c623b44546f4cbe025c81fd065df700f26a6323bd4dca38c80ad6bf21bffa1de7234ae5365e8be8ceec09d8841bc4dd28f05492
TLSH
T15EC0025E37A5141AB8A2E25B54F3102AAA73BDA711388C0D12E6134C18FE944614079F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/908-2-0x00000000008C0000-0x0000000000A0D000-memory.dmp

Download