1fee8c34df72af9c5d844cc10bf7be1857a5fe2b979c850850cdb67f0c0e977d

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1fee8c34df72af9c5d844cc10bf7be1857a5fe2b979c850850cdb67f0c0e977d.exe
Size 430KB
Sample260815-ckq2wsdc94
SHA256 1fee8c34df72af9c5d844cc10bf7be1857a5fe2b979c850850cdb67f0c0e977d
MD5 739ba4ba5623be747141c96f19220653
SHA1 38fadac6fd880867634f4a00a1df07bcbbe14c56
SHA512 fac8a6b80a75bd79ec426a3543d1d1a23e1947aff4ae11c43e68a57cccf9fce62fb50b29a02aec6c56a9088a7fe5677d1830cc6a7fd984afa93b3b57ea80f88b
SSDEEP 6144:YLcvVsoKBlr25QGp/jzKV3u1nxb3TstwirEE7XXy6:nGjBl25np/jzKV3u1nxrTstNEEL
TLSH
T1C2948D207E82D132E6921132977EDBB1497DA630171B21CB37E81A3A6FB07D19B3535E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1fee8c34df72af9c5d844cc10bf7be1857a5fe2b979c850850cdb67f0c0e977d.exe

C:\Users\Admin\AppData\Local\Temp\1fee8c34df72af9c5d844cc10bf7be1857a5fe2b979c850850cdb67f0c0e977d.exe
"C:\Users\Admin\AppData\Local\Temp\1fee8c34df72af9c5d844cc10bf7be1857a5fe2b979c850850cdb67f0c0e977d.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4508-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download