536272950f0cb87fc9e416a70ea7fa373c30b521700ddea1e50f13fc3338c2b4

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
536272950f0cb87fc9e416a70ea7fa373c30b521700ddea1e50f13fc3338c2b4.exe
Size 276KB
Sample260804-v82seaed99
SHA256 536272950f0cb87fc9e416a70ea7fa373c30b521700ddea1e50f13fc3338c2b4
MD5 aa8ed8ead8d16a125f1c385f3d968871
SHA1 24af8322b374f38fbb853f4564d7d9e95274a4d9
SHA512 d19e58f03f5b65d056a6a8c1d672dad8ecd53c05ef88eb20c9db64100163c11a8f8f362bb2d7d1d50391c0fbf38cff709af391984c7d6c7eb6ff8fdf9c295fad
SSDEEP 6144:cQZXVRBpEu/tT1tlhBo4q2YXAyL1L3BYq:DVRTEu/txzhBo02FxD
TLSH
T14754AE2176E4CC96E5E53632CDB37330E7F6F5268931F66F3794124C9E3A9408A26326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	536272950f0cb87fc9e416a70ea7fa373c30b521700ddea1e50f13fc3338c2b4.exe

C:\Users\Admin\AppData\Local\Temp\536272950f0cb87fc9e416a70ea7fa373c30b521700ddea1e50f13fc3338c2b4.exe
"C:\Users\Admin\AppData\Local\Temp\536272950f0cb87fc9e416a70ea7fa373c30b521700ddea1e50f13fc3338c2b4.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5088-0-0x0000000000400000-0x000000000044A000-memory.dmp

Download