6cf4b71aa1d43b5864044a4a6ca6cab0d3d4cd4d5da7704e77ba12c9ed8e2328

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6cf4b71aa1d43b5864044a4a6ca6cab0d3d4cd4d5da7704e77ba12c9ed8e2328.exe
Size 1.5MB
Sample260511-rs34ract81
SHA256 6cf4b71aa1d43b5864044a4a6ca6cab0d3d4cd4d5da7704e77ba12c9ed8e2328
MD5 d4e04fbd8a3542c16e696609b43b5459
SHA1 2510a0c8ff51febf1d3a173901bf36e90716235d
SHA512 9bb183860c7c7cbf6964a7a4b17d336d2783f1493d1ac82f6ad3dc18a4683fb13771fb0261868dc54319e58adecb8a4fd9c5d32bfc44459c4ac3449e52358ecd
SSDEEP 24576:LfZ9SJ4hb2UxvVNFfw+BtiKC3DivzuEAOIGR1Mfp6C:z5hvLjiUvVlIGR1tC
TLSH
T1EE759F32BD42C032D1A211719939AB7A49BDBE75273440EBA3D43E2D8D715E36A3533B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6cf4b71aa1d43b5864044a4a6ca6cab0d3d4cd4d5da7704e77ba12c9ed8e2328.exe

C:\Users\Admin\AppData\Local\Temp\6cf4b71aa1d43b5864044a4a6ca6cab0d3d4cd4d5da7704e77ba12c9ed8e2328.exe
"C:\Users\Admin\AppData\Local\Temp\6cf4b71aa1d43b5864044a4a6ca6cab0d3d4cd4d5da7704e77ba12c9ed8e2328.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

58b509c3f65696668c836e38a17ee52b_65dc1a62-061b-4040-8d93-05d60f01afbe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2122505878-652277452-2375749442-1000\58b509c3f65696668c836e38a17ee52b_65dc1a62-061b-4040-8d93-05d60f01afbe
Size 52B
SHA256 5c4647f65619cae1cf6a0ee07865199b68bdd3a825501f403866e11201ccd388
MD5 71f0a0976ffb68beb323f97d898bde77
SHA1 c89707a323bd14f34b97390cb8be7cf92113431e
SHA512 620c78bbacdbadb92543ecc5a7a49d43ff5a0d1ec701fb301c9cd074df3a97b0c7a786de87b7680cde8f9dc85b7a43305b4bd7e06f4b7464d7afcf97628e610e
MD5 SHA1 SHA512

Submit Download

memory/1720-0-0x00000000000B0000-0x0000000000243000-memory.dmp

Download