1ab7375550516d7445c47fd9b551ed864f227401a14ff3f1ff0d70caca3bd997

Analysis

user interaction
yes
max time kernel
599s
max time network
343s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Monoxidex86.harmless.exe
Size 131KB
Sample260605-ja9vkscs4x
SHA256 1ab7375550516d7445c47fd9b551ed864f227401a14ff3f1ff0d70caca3bd997
MD5 bd65d387482def1fe00b50406f731763
SHA1 d06a2ba2e29228f443f97d1dd3a8da5dd7df5903
SHA512 351ecd109c4d49bc822e8ade73a9516c4a531ebcda63546c155e677dcff19708068dc588b2fcf30cad086238e8b206fc5f349d37dda02d3c3a8d9b570d92e4d9
SSDEEP 3072:yC1uNIhRRMavV44UAh1fwNoDiAG7BNS0O6WBHMz/:UehRRtv24UAh8oDvMg0ORBH2/
TLSH
T16BD37C00B0C1C4B2D5B5193118B5FAA64E3DFE740B249EFF77D81A6A4EB41C129B396B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Monoxidex86.harmless.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	948	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	948	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\Monoxidex86.harmless.exe
"C:\Users\Admin\AppData\Local\Temp\Monoxidex86.harmless.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4076

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads