8c2ba0bd270fa646b54534f7c644cc9bb3f38691f2646e0f8e1af02f020f6cad

Analysis

user interaction
yes
max time kernel
898s
max time network
397s
platform
windows10-2004_x64
resource
win10v2004-20260130-uk
resource tags

arch:x64arch:x86image:win10v2004-20260130-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
11/05/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pes2009.exe
Size 46.4MB
Sample260511-vhcetsfs6v
SHA256 8c2ba0bd270fa646b54534f7c644cc9bb3f38691f2646e0f8e1af02f020f6cad
MD5 0da992b62e802bb6f137b4850123cb8c
SHA1 7a29db4db7150a6db4579f0dd650df40f9c27655
SHA512 1e553bea892dabb6882672d5f58610f9c5f0881b1965b59cd90190876adff1e76d3bf809adc20bde943d70030e0a03d26c183d57b30de30e7ee804f7035f90ac
SSDEEP 196608:nXBpKn79ZG64nGLGTIEv+zjbS5ERCy/YZDdXrOvoj045RRS6owxpWFUSnm6qsWgx:XeV4nNrSjzRCy/GDdXrOvojEkxpJs1X
TLSH
T1C9B79EE9F78502B1ED5904B89119BB3D4334D7004B669BD7E990FA05EEE3AF1BC38981
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pes2009.exe

C:\Users\Admin\AppData\Local\Temp\pes2009.exe
"C:\Users\Admin\AppData\Local\Temp\pes2009.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1356-0-0x0000000000400000-0x0000000003261550-memory.dmp

Download

memory/1356-1-0x0000000000400000-0x0000000003261550-memory.dmp