ec05e0bcf6dae3e6d10ddc740d34478fadf18ed90492b594c834fad6b7ef6c87

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ec05e0bcf6dae3e6d10ddc740d34478fadf18ed90492b594c834fad6b7ef6c87.exe
Size 2.7MB
Sample260529-gr889sdv8k
SHA256 ec05e0bcf6dae3e6d10ddc740d34478fadf18ed90492b594c834fad6b7ef6c87
MD5 2bd4ed0d69d3e8f7bc427d232586c903
SHA1 685d46f326b675afad273d0720fc5b3e01209daf
SHA512 b6e4bdf66afe72af3526523924a6115704b407b45a3825215701fd3270583aa8a38e069c18c4243ccc8abccf341edd6bab7693c253ede2edf62ab2850d2ff00a
SSDEEP 49152:Y6omQ215oHbwrA2AoHxTFT9ggvhiWaOuBuUXqY7RC0WPSfiW:loD215MbwsKpggvhiWaOuBuUXqY7RC05
TLSH
T1CCD56E21A3C18637D5721E77AC2AD798A8297E301A74880B3EF57B4C5F3DB817D29253
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec05e0bcf6dae3e6d10ddc740d34478fadf18ed90492b594c834fad6b7ef6c87.exe

C:\Users\Admin\AppData\Local\Temp\ec05e0bcf6dae3e6d10ddc740d34478fadf18ed90492b594c834fad6b7ef6c87.exe
"C:\Users\Admin\AppData\Local\Temp\ec05e0bcf6dae3e6d10ddc740d34478fadf18ed90492b594c834fad6b7ef6c87.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5252-0-0x0000000000400000-0x00000000006B2000-memory.dmp

Download