c8e26b4044d33a068d63813783f9b6a50e3a8a580d22423572de10e3a36ddfbd

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c8e26b4044d33a068d63813783f9b6a50e3a8a580d22423572de10e3a36ddfbd.exe
Size 7.9MB
Sample260803-ldcelatblh
SHA256 c8e26b4044d33a068d63813783f9b6a50e3a8a580d22423572de10e3a36ddfbd
MD5 a4445e2576ff3f0a92875e46e79f2cac
SHA1 ee8b82d3c4d432397bb91eef24af6240a6f88c56
SHA512 5416e23371e79d3384b6ee2dc0fedbd90505ad22739c9cb7d2e375edaface7f68d2679c56393941ca8d7a5677966e51eae9d0b102f2c53f2266bd5dece9d0140
SSDEEP 98304:ooRAzZrEEEXeky8UjyWwViP9cOcLby7uh50GsVUoi4CFKTNBDJqdA4DBfVr:iYEe68Uprcfy7uh50jCaWxBfVr
TLSH
T1F886D0117A82C035C753127049BCBBAB44FDEA940F3956CBA39C162DAF715D31A32AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8e26b4044d33a068d63813783f9b6a50e3a8a580d22423572de10e3a36ddfbd.exe

C:\Users\Admin\AppData\Local\Temp\c8e26b4044d33a068d63813783f9b6a50e3a8a580d22423572de10e3a36ddfbd.exe
"C:\Users\Admin\AppData\Local\Temp\c8e26b4044d33a068d63813783f9b6a50e3a8a580d22423572de10e3a36ddfbd.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1528-1-0x0000000003010000-0x0000000003020000-memory.dmp

Download

memory/1528-2-0x0000000003010000-0x0000000003020000-memory.dmp