1f587124548aa1c9575b9c52dd3e95ec546231016a6299415e578f080e43ad13

Analysis

user interaction
yes
max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
halo.exe
Size 3.4MB
Sample260804-rf3mfssdlg
SHA256 1f587124548aa1c9575b9c52dd3e95ec546231016a6299415e578f080e43ad13
MD5 48b7067549d0aa5d8fc14e38dd82d352
SHA1 a19bc09ae22bb37668db273981d283fd21167503
SHA512 b1cd69ee2069fa4daeb9488181cdbd967df8adb273452fc13e9d7bfdf02c5c17e5cd16fe4d509c7b0cb58f42d245d6f625a1e2921ea7bd7c6711b59436cb25f0
SSDEEP 98304:rjrMDRTHCMbPQRieREoi2ZFo1Tf9fu70sAh1eJ7:3rMDZCMb4RieRoYALe1
TLSH
T1B2F5D0C2F68680B1CB961579104FA73BAA314F58173906C3E3E83D6BADF36E14179E49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	halo.exe

C:\Users\Admin\AppData\Local\Temp\halo.exe
"C:\Users\Admin\AppData\Local\Temp\halo.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1060-0-0x0000000000400000-0x0000000000889000-memory.dmp

Download