49990cab4b53abae46e0312f8121f38d353d2793580fedf5862d6c07d8a5a13f

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
49990cab4b53abae46e0312f8121f38d353d2793580fedf5862d6c07d8a5a13f.exe
Size 1.8MB
Sample260602-ex8tksez7p
SHA256 49990cab4b53abae46e0312f8121f38d353d2793580fedf5862d6c07d8a5a13f
MD5 30416d5ce2842bdcebbf3872011d7609
SHA1 2906b436f9974b680c2a9f981f6d216ffc6d9859
SHA512 844e8583a19900b14a401206d455d9b15b4549256d372dadc328fba21507b52c37e8a1557272e1e49cd83d36e813015a99c55384a3f96dddf5e54779ed903b72
SSDEEP 49152:DZmRlaldyxa0x+z8KuqGaX0eoIBAUZLYHH46m:1m/algxa03SBAUZLL
TLSH
T1CD85D001F3C2C5B2F5235032897B677B897AEE214B11CAA3F394FE9D5D32390957912A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49990cab4b53abae46e0312f8121f38d353d2793580fedf5862d6c07d8a5a13f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5500	49990cab4b53abae46e0312f8121f38d353d2793580fedf5862d6c07d8a5a13f.exe
5500	49990cab4b53abae46e0312f8121f38d353d2793580fedf5862d6c07d8a5a13f.exe

C:\Users\Admin\AppData\Local\Temp\49990cab4b53abae46e0312f8121f38d353d2793580fedf5862d6c07d8a5a13f.exe
"C:\Users\Admin\AppData\Local\Temp\49990cab4b53abae46e0312f8121f38d353d2793580fedf5862d6c07d8a5a13f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5500-0-0x0000000000590000-0x0000000000761000-memory.dmp

Download