66252b80e1f62e284d60ddfc340fa7d6b651929d85360cee0f78cc04a8c5e343

Resubmissions

18/07/2026, 04:25

260718-e2f95ags9r3

18/07/2026, 04:24

260718-e1k7pags9m3

Analysis

user interaction
yes
max time kernel
72s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QRes.exe
Size 4KB
Sample260718-e1k7pags9m
SHA256 66252b80e1f62e284d60ddfc340fa7d6b651929d85360cee0f78cc04a8c5e343
MD5 ca493006d55ebda9f97c7848cee144a7
SHA1 82671680c2fd7037e3982da62227bfa9611f91ee
SHA512 35f0eada98d97edfea875f1301eeb84fb81d9e1f59a63098bb73b963bf6d463fb5c780840a3aacbcf6d2e7fb8fbda139bb1c61625b6f334cf4fe6d5677fcc035
SSDEEP 96:XsK1jHA1J4NV/HMjiNOi7XV8jr1enQYzjaADfNP4oyn:dj/Hco8jrgQoja2fNP4oyn
TLSH
T18B912B0BEF987633DAEA45F83D0CD3506B339948C6D79F4726146368226502BD5F4787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QRes.exe

C:\Users\Admin\AppData\Local\Temp\QRes.exe
"C:\Users\Admin\AppData\Local\Temp\QRes.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3548-0-0x0000000000401000-0x0000000000402000-memory.dmp

Download