5eeade2083984146224f34be3d2086905ada53176f3d2af1dbe18cda9238a4ee

Resubmissions

07/08/2026, 21:11

260807-z1pv4acn6t9

04/08/2026, 15:06

260804-sgrf9ahj5v3

Analysis

max time kernel
28s
max time network
31s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
protectMeMommy 2.exe
Size 528KB
Sample260804-sgrf9ahj5v
SHA256 5eeade2083984146224f34be3d2086905ada53176f3d2af1dbe18cda9238a4ee
MD5 0b0cd39238c2057e44832c05cd678308
SHA1 3917e77229ef79680f5dc8d5299c87c538b25f9d
SHA512 d6d6deaf690749d01bebd8c8ed4781d14f6e9337c32704834cf049f77028d6bdfb4765f60d332ee6326d46e474efddd2389763ef7e53ef14a10cd0be3691ce5b
SSDEEP 12288:roSWNTbvyEjo4x3Zt3h38qGWBzYfWXTUXO2NR5/FR:roS2TbvyyLpDR38qGxkx2PR
TLSH
T1AAB40141B2C2C2F7D5E204340586E16E9B357F289B6499D7FB8C3F9E29369D061383E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	protectMeMommy 2.exe

C:\Users\Admin\AppData\Local\Temp\protectMeMommy 2.exe
"C:\Users\Admin\AppData\Local\Temp\protectMeMommy 2.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3760-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download