1c06b55a04b6437ddef8b8379d4591821586c56197ca7524bc2f4b21132e1347

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1c06b55a04b6437ddef8b8379d4591821586c56197ca7524bc2f4b21132e1347.exe
Size 1.2MB
Sample260815-r1bdpsycld
SHA256 1c06b55a04b6437ddef8b8379d4591821586c56197ca7524bc2f4b21132e1347
MD5 ed3516157be2879a391da298dd2efefe
SHA1 ea43f3379ae5cbefa1952b750fe994678072da9b
SHA512 8fd201b53e0248fb002775f4c68e176eb7a655dae95b2d52deecc706d8f16b5a21f4a9506445b560b27140abd994b1e0051cd799813cca0e8099e26f95f86fc4
SSDEEP 24576:qkl5o0JJwyNTYYehR7yTZ7qkCjC95X/tl0M/Xui79oilbIJeg2:hzJJ5E7yTZ7qkCjCDsM/v92eR
TLSH
T179556D29EA4611F8D91787F0899FE7BB8B147A348036DD6FFF8DCA04B4335123859266
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c06b55a04b6437ddef8b8379d4591821586c56197ca7524bc2f4b21132e1347.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4296	1c06b55a04b6437ddef8b8379d4591821586c56197ca7524bc2f4b21132e1347.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4296	1c06b55a04b6437ddef8b8379d4591821586c56197ca7524bc2f4b21132e1347.exe

C:\Users\Admin\AppData\Local\Temp\1c06b55a04b6437ddef8b8379d4591821586c56197ca7524bc2f4b21132e1347.exe
"C:\Users\Admin\AppData\Local\Temp\1c06b55a04b6437ddef8b8379d4591821586c56197ca7524bc2f4b21132e1347.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

launcher_config.ini

Path C:\Users\Admin\AppData\Local\Temp\launcher_config.ini
Size 348B
SHA256 03a0b173f2f83b54725636c0c2606360d3e5593f51bcd8d1cec393a9ce70be51
MD5 610c369630999a1301cd52c6ae849c10
SHA1 ac40ab29c31b0d5c66be2621e6ed5d1b8d61c449
SHA512 45d4678f97e8ea62276e6180cf482c462d364a0a46273337c92ed4633dc8286e2a0e6b5f72dafbeb46832dcd828eae530eda2825cf23dfe385f936455254b910
TLSH
T17CE02D800E002842E076E4ACE8A71BC0E0AAB00F88C15074FF2846DE1ABD43D22D8A03
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4296-35-0x00000000003A0000-0x00000000004DF000-memory.dmp

Download