014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89

Resubmissions

15/09/2026, 11:29

260915-nlkgaatzg1

07/08/2026, 14:21

07/08/2026, 14:20

06/08/2026, 22:19

06/08/2026, 22:01

06/08/2026, 03:44

10/07/2026, 00:11

Analysis

max time kernel
599s
max time network
480s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89.exe
Size 1.0MB
Sample260806-ear8baff46
SHA256 014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89
MD5 00b24dcb1665fc7c6e67e51ed80d660f
SHA1 928f0cde4c8d935e181aa9b1990d72cbe58fd6eb
SHA512 588119d135c3a8d3cd3037da882a5e75f02075848f5a2624ead6739fd0e4c984493bfad6daa48306e8b30c03744156bc3be04532cfea7d2492212ce3f78e41d6
SSDEEP 24576:9QurI9Kqgrkv7yNS9QgPB5zbuawcXQhgKF:9QAI9KfQyEQq2O2XF
TLSH
T1E735122237D0CDF6F1625E306952C6A49AEBBC265E25558FCB84672F0E370E087ED346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
996	1908	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89.exe

C:\Users\Admin\AppData\Local\Temp\014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89.exe
"C:\Users\Admin\AppData\Local\Temp\014cbdc259ef1fde1a1e27b064eebcfa8344075d591dad1ab56888df71a13a89.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 276
  2⤵
  - Program crash
  PID:996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1908 -ip 1908
1⤵
PID:4208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1908-1-0x0000000004C50000-0x0000000004D24000-memory.dmp

Download

memory/1908-2-0x0000000004D30000-0x0000000004E11000-memory.dmp