64b010c1534527636d9379a704f1241870349971c27f33c97d4c2761c949256c

Analysis

max time kernel
898s
max time network
430s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/08/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
turbo_vpn-service.exe
Size 1.0MB
Sample260809-egqm3agf33
SHA256 64b010c1534527636d9379a704f1241870349971c27f33c97d4c2761c949256c
MD5 0bee4138e1f17caf50f0c9cf10bfbc43
SHA1 ed5ef7b5db78e1882ba11b988fd0d9ae36f55fa6
SHA512 a2ff1d65e9763a61f39fda85a598c60cd4e41118730ffce3acb4ba081e4dfed9a494d75e5fb1b70fa17f5526e5adee6441b25c3e894c0abff33cb550c6d9f8cb
SSDEEP 24576:dCbT7Xkk0D1ZKp2pDPs0Cft0Lt6QSuTkpECdK0K4JRHLB:dO7XqDKYpD0zSTkqQK0K4HH9
TLSH
T10C35BF207982C0B3DBA20570597DEB37453DBD290B249DCBA3D47A3D4E302E35A7967A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	turbo_vpn-service.exe

C:\Users\Admin\AppData\Local\Temp\turbo_vpn-service.exe
"C:\Users\Admin\AppData\Local\Temp\turbo_vpn-service.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads