0b5cdc43f47de17342b7c179d2b3b862b7b2614aa924350a39ab98b0403972c9

Analysis

user interaction
yes
max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 1.4MB
Sample260709-2fvlysat6m
SHA256 0b5cdc43f47de17342b7c179d2b3b862b7b2614aa924350a39ab98b0403972c9
MD5 b30ce23e9c8639bc706091f2c2a3a83f
SHA1 c3595c60c64c629f87d615da07462f0c6d4ccfc7
SHA512 c4f8ed42b9728d67e45287684a88362bae36a25adedd19a08d7c939cd880a42a2bf20f38cf93ebdf60c1a74ec45db21ef38e8500c1d698d07a1730a1aaf5aa8d
SSDEEP 24576:U1VqyG3T/+ofiDIZE2kChYYmpY9a2nWEdEC6GnJJ3GYnDWK2Muqvx9b8:IQdhZgEN6GnJNDWK29Gm
TLSH
T15D655C22A3924437D5731F759D6BC2A46C26BE202E74D54A7EF8BE0D2E38B407D35392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5808-0-0x0000000002390000-0x0000000002391000-memory.dmp

Download

memory/5808-1-0x0000000000400000-0x0000000000569000-memory.dmp