343b58fde0b7f9da08d7401905b513fc29eedd48c7cf6d4c006fa766230b4295

Analysis

user interaction
yes
max time kernel
10s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/07/2026, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
launcher.exe
Size 937KB
Sample260709-mgqbashw31
SHA256 343b58fde0b7f9da08d7401905b513fc29eedd48c7cf6d4c006fa766230b4295
MD5 e920e053dd1e4dbe627587bf3a7f746c
SHA1 da69262c7a596e476f12693a5b7676f81d0e7a85
SHA512 2c3862b753fef947eb490c51fbe4a9e1b6e6927e17881e5b7fa2e78b4fcae78adea7a4aca7de2d1ca715beed19d1f9ec3d6746b6122fbbad9185a1d2a3b7ed66
SSDEEP 24576:FzU9QaRolgepXs4gFy6UC4AWoLu64po3UF:WMSepXs4gQ6UC4AWuGo
TLSH
T145157C1174C28071D5A30171782FBF788BADBD145B3C16FB27947A2E9A372F22935A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	launcher.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2424	launcher.exe
2424	launcher.exe
2424	launcher.exe
2424	launcher.exe
2424	launcher.exe
2424	launcher.exe
2424	launcher.exe
2424	launcher.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 3516	2424	launcher.exe	80

C:\Users\Admin\AppData\Local\Temp\launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\launcher.exe
  launcher.exe -run wallpaper32.exe -final -showbrowse -language english
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

log.txt

Path C:\Users\Admin\AppData\Local\Temp\log.txt
Size 540B
SHA256 4b64c13f528d07bb06473e5e3eaf4caf063e9b677c9ee7cefe1d395e90465726
MD5 1e9589ce47a66d4c7f79c401d4a6dc00
SHA1 eb60719088445f39c8bd9580a6031611da08c8d2
SHA512 7cf33d692d758d2582a894011d8a2cb899fe22e9b9dd60322ecf1916fa00c1a037cd2a1b17ad88e99337d8c6c0f5714d86c96495af8b10721a397484e2e01190
TLSH
T1A1F08BB585D202433D050392BC581C2C8846369C224C2199566502ACA75C5EFFFF20E0
MD5 SHA1 SHA512 TLSH

Submit Download