4de64473aa107e02a99105071c9ed5f3d598512e3a983158c76128e82a9ed651

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4de64473aa107e02a99105071c9ed5f3d598512e3a983158c76128e82a9ed651.exe
Size 12.0MB
Sample260803-j3wtestzdw
SHA256 4de64473aa107e02a99105071c9ed5f3d598512e3a983158c76128e82a9ed651
MD5 c4f610903f6673093323272a4f6d2d74
SHA1 fd3f9a545e4c1bb3fb780e704bdf5550314a9db9
SHA512 0f3b1968904bad22c05b93b634e06f185b18776bd219db33aaec608a076d8e020e84f6b924fa8180e61c38ca16a706250ccff6603e5a9e90895c2ac9a41a07ee
SSDEEP 49152:6YdiRx44rT/XAKqTci6+09hN6LrpFTjrSOI:6Y2x4eLA/6+0HN6xRrSO
TLSH
T186C66D21A343E93BF5B304B9D57D969D346CBF304B18D0D7A2C82D5D2AB82E16E31A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4de64473aa107e02a99105071c9ed5f3d598512e3a983158c76128e82a9ed651.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	4de64473aa107e02a99105071c9ed5f3d598512e3a983158c76128e82a9ed651.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4924	4de64473aa107e02a99105071c9ed5f3d598512e3a983158c76128e82a9ed651.exe
4924	4de64473aa107e02a99105071c9ed5f3d598512e3a983158c76128e82a9ed651.exe

C:\Users\Admin\AppData\Local\Temp\4de64473aa107e02a99105071c9ed5f3d598512e3a983158c76128e82a9ed651.exe
"C:\Users\Admin\AppData\Local\Temp\4de64473aa107e02a99105071c9ed5f3d598512e3a983158c76128e82a9ed651.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4924-1-0x0000000003CA0000-0x0000000003DA0000-memory.dmp

Download

memory/4924-2-0x0000000003CA0000-0x0000000003DA0000-memory.dmp