fef0ddae37c9abc00eca0cb2585501abc35f75f00ea0283219be718e5c0855e3

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-ja
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 08:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EXSTIA1ss01.exe
Size 4.9MB
Sample260713-kq38eagv21
SHA256 fef0ddae37c9abc00eca0cb2585501abc35f75f00ea0283219be718e5c0855e3
MD5 ac685a82a5c12fdb5c7c11747ee7a926
SHA1 18f25db54dd36c452b688bc82607cfb116f22d4c
SHA512 5d5085c3bb16f0a8c75d7f022a999e61ac0a2ef78a5e8996974b59f8135701bcf8743340bf23f999e5f9dfb45c188526cc3e43eaac950b0fb58bececb14db6c3
SSDEEP 98304:YX8j1Ld15ssHJAX17TuQrK21xqXmkVUeHC7HCiPNIYHl+rgEzDlDq8+dVw:YX89PqaA8QrhxqXmkVUeHC7HCiPNIYH
TLSH
T165369E12F640D43BD0A215718A26E7F5657A7F302E00A66777907BAC3EB07D1DE123AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXSTIA1ss01.exe

C:\Users\Admin\AppData\Local\Temp\EXSTIA1ss01.exe
"C:\Users\Admin\AppData\Local\Temp\EXSTIA1ss01.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2572-0-0x0000000000400000-0x0000000000CF4000-memory.dmp

Download