95cd48f1aba862d381ff4ee283b44433645c9d4a03846af2249fd08fe5f4914a

Analysis

max time kernel
148s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
95cd48f1aba862d381ff4ee283b44433645c9d4a03846af2249fd08fe5f4914a.exe
Size 588KB
Sample260706-pwymbsft3s
SHA256 95cd48f1aba862d381ff4ee283b44433645c9d4a03846af2249fd08fe5f4914a
MD5 8ec3d7c5b89fc399c8fcb61340af80e1
SHA1 ce4f0549e70998f740cebed06e7d3a7af87d5e8e
SHA512 2c03e5448f03a527a41276fc28fcf8f154450da8b5aba00ff87c7e33820c6b4100ad114b8b865e0a5de74cd219d4da8b1d57045f24e231953d9536ca71702799
SSDEEP 12288:H8Os7QO/zJ0nhMaCV8oWJeTvJoPsnm5YxJ:cl7QO/90nhMaCV8oWJqPnm5YxJ
TLSH
T103D47C23F121E0B2D05657F75AA54B3C7AF89A1418714993EFE0CEB07C729A3CB6660D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95cd48f1aba862d381ff4ee283b44433645c9d4a03846af2249fd08fe5f4914a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5608	95cd48f1aba862d381ff4ee283b44433645c9d4a03846af2249fd08fe5f4914a.exe
5608	95cd48f1aba862d381ff4ee283b44433645c9d4a03846af2249fd08fe5f4914a.exe

C:\Users\Admin\AppData\Local\Temp\95cd48f1aba862d381ff4ee283b44433645c9d4a03846af2249fd08fe5f4914a.exe
"C:\Users\Admin\AppData\Local\Temp\95cd48f1aba862d381ff4ee283b44433645c9d4a03846af2249fd08fe5f4914a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5608-1-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5608-3-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5608-0-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/5608-4-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5608-6-0x0000000000400000-0x0000000000497000-memory.dmp

Download