013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8

Resubmissions

15/09/2026, 11:29

260915-nlkgaatzg1

07/08/2026, 14:21

07/08/2026, 14:20

06/08/2026, 22:19

06/08/2026, 22:01

06/08/2026, 03:44

10/07/2026, 00:11

Analysis

max time kernel
599s
max time network
535s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe
Size 955KB
Sample260806-ear8baff46
SHA256 013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8
MD5 13694c1e016d5a35d902070111f63d18
SHA1 8a7de1581df4a927a1b5144af9d590750649aa2c
SHA512 5ddc6f8a61d0879a337f6eb751cfdf8965ba6efcc59abb1fe84f5a304588e0738be214c76dbf6d565d72ec00b8ae398c62f1492a66510926d452c1eca16e6b89
SSDEEP 24576:nnrmNg9r6EAsSDBpvEwL55pkRT8cDbhvKyew4:n39r6/DjlL55rcHE5w4
TLSH
T1662523596BF72123F1B1A930313486B07BA7BE307A70A29D1654116C1F786E35AB0F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	5892	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe

C:\Users\Admin\AppData\Local\Temp\013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe
"C:\Users\Admin\AppData\Local\Temp\013ed964d37e80ee700dd98ba83bc25692ee92b4895b92eed17c4ef5359432f8.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5892 -s 316
  2⤵
  - Program crash
  PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5892 -ip 5892
1⤵
PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5892-1-0x00000000035D0000-0x00000000036A2000-memory.dmp

Download

memory/5892-2-0x00000000036B0000-0x0000000003791000-memory.dmp