a0c5ca86dee9fccd07eee2d44dab052de6441450e44b733441fcfc697dea0828

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 06:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0c5ca86dee9fccd07eee2d44dab052de6441450e44b733441fcfc697dea0828.exe
Size 8.5MB
Sample260601-gs4eeadt61
SHA256 a0c5ca86dee9fccd07eee2d44dab052de6441450e44b733441fcfc697dea0828
MD5 5fd13a8281fd4b37cb55eeee70ae7e5f
SHA1 ba533dfa550634fc7d9c00b1cddeeaa94e7385c3
SHA512 bc25c08887ba93f1cdb3fd90e6b732b77fad8262c75bb388e0094a92415c3579864de13986a9a1affac1d5cc27fe1251eb9e3559ed3180e2e583c92dd5f8ce1c
SSDEEP 98304:hcKUKwdHBfQmSfENibGpYKiGgSy1SILvdNmSJp6FbvpfwNbRs+uV1usvTp/wkeTM:h6xdHFY1STYpOpfwNbWBhvd/wrJawar
TLSH
T133960121F6B2C076D59652309A3DBFB644BCA634CB2084C773C05E2E5E315E3E635B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0c5ca86dee9fccd07eee2d44dab052de6441450e44b733441fcfc697dea0828.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1520	a0c5ca86dee9fccd07eee2d44dab052de6441450e44b733441fcfc697dea0828.exe

C:\Users\Admin\AppData\Local\Temp\a0c5ca86dee9fccd07eee2d44dab052de6441450e44b733441fcfc697dea0828.exe
"C:\Users\Admin\AppData\Local\Temp\a0c5ca86dee9fccd07eee2d44dab052de6441450e44b733441fcfc697dea0828.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:1520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-0-0x0000000000150000-0x00000000009D8000-memory.dmp

Download