84d9dbe132df3b207472daf0712a481f2c4a1deb6aff3ffd680ad6a578416308

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
84d9dbe132df3b207472daf0712a481f2c4a1deb6aff3ffd680ad6a578416308.exe
Size 299KB
Sample260805-bca52abc73
SHA256 84d9dbe132df3b207472daf0712a481f2c4a1deb6aff3ffd680ad6a578416308
MD5 25306510d8a6b867cb0d7649c82dec9d
SHA1 f5784a90a35e57aa01f25373af0b67d19f03b04c
SHA512 cb7beed7797fae39dab42c382c849633c7f6d7bf1dffc9346973aa6b7887668c01a90bd955357ee4026401bd1f19ae5d65088957cb99dafe99e691003b0850ec
SSDEEP 6144:ZdKNEzd0BWDtgRAd6yRptgMSSvoAOrxqUb:Z9zd0BWDBYyVgQQ/qUb
TLSH
T145549C017696C032E2724932197CDB77513DB8304F269ADBE3D45F2EDA745C2AA31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84d9dbe132df3b207472daf0712a481f2c4a1deb6aff3ffd680ad6a578416308.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4356	84d9dbe132df3b207472daf0712a481f2c4a1deb6aff3ffd680ad6a578416308.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4356	84d9dbe132df3b207472daf0712a481f2c4a1deb6aff3ffd680ad6a578416308.exe

C:\Users\Admin\AppData\Local\Temp\84d9dbe132df3b207472daf0712a481f2c4a1deb6aff3ffd680ad6a578416308.exe
"C:\Users\Admin\AppData\Local\Temp\84d9dbe132df3b207472daf0712a481f2c4a1deb6aff3ffd680ad6a578416308.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

launcher_config.ini

Path C:\Users\Admin\AppData\Local\Temp\launcher_config.ini
Size 348B
SHA256 4fe2bb845fa7d4304299bb7fd97476b32f45e9599d1fd6485bf30e9041ae6200
MD5 293551379147a9e5c0204b431488c56e
SHA1 298b7197cc0009690981654acc03efd24a695223
SHA512 5ccf3a0259fc9ef603d793abfc65c1dd0994ad9114f080fc43a42afea5acd5668c1df2cacabcfdfc52bc7b7e1ae1b59c103a90132a8ee02cc32bf75e5cb1af56
TLSH
T1D2E02D800E002842E076E4ACE8A31BC0E0AAB00E88C150B4FF384BDE1ABD43C2698E03
MD5 SHA1 SHA512 TLSH

Submit Download