cd4f091dd90ffd4d1c2b30a13e0a1b969cdb8fc6829962c80de4e95482e30f08

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cd4f091dd90ffd4d1c2b30a13e0a1b969cdb8fc6829962c80de4e95482e30f08.exe
Size 2.8MB
Sample260805-c1bl5scb94
SHA256 cd4f091dd90ffd4d1c2b30a13e0a1b969cdb8fc6829962c80de4e95482e30f08
MD5 c54bcb00d396b5ccf487abc7a9c422f1
SHA1 592edc8ab57306c1cb0f274c03f8117c568c8d34
SHA512 9c7b660a9d0982cf6c195d174ca88f769d1bfbf00fa6b2368f34cb8b15938de01c9f1f9118f80b2bce2969cb520de60fd110a1361701e4ffed930473d7217f87
SSDEEP 49152:ZMxc9EYuffdhu5OviynjUzXPIGEvVcV0Sxx/O/ndIC4nv4ajQQVWmDfvKEs+Tpw:igu9hviynj8Ip+nxVEenv4iQQVkEG
TLSH
T12AD523B49ECB11EADEC10974A703DBE73AB5199248D68C347AC13805B173FB7216E52B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd4f091dd90ffd4d1c2b30a13e0a1b969cdb8fc6829962c80de4e95482e30f08.exe

C:\Users\Admin\AppData\Local\Temp\cd4f091dd90ffd4d1c2b30a13e0a1b969cdb8fc6829962c80de4e95482e30f08.exe
"C:\Users\Admin\AppData\Local\Temp\cd4f091dd90ffd4d1c2b30a13e0a1b969cdb8fc6829962c80de4e95482e30f08.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/980-2-0x0000000000830000-0x0000000000CF1000-memory.dmp

Download