d6e181a6e543b4581363400a61dfa7cd2739e9721243568d62c2a4637fac8e06

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d6e181a6e543b4581363400a61dfa7cd2739e9721243568d62c2a4637fac8e06.exe
Size 717KB
Sample260816-btevjsaf24
SHA256 d6e181a6e543b4581363400a61dfa7cd2739e9721243568d62c2a4637fac8e06
MD5 495a4c55615a93db0eb4dd725fbe2e2d
SHA1 ce190b0b0451bace06d5d804c2557aa986cac33d
SHA512 f97bf7a8be89cd9fe43cb64b5356aa2331c7b034073079a81d61d2621ba9ca294a314ea3b8cfe595aadf26f4ebf51548f340caaca4e8ae8309596ef0aa2baea3
SSDEEP 12288:YehtvpOsb/8vchRoeKhQwkmyMqP5kLMrE7WVyG5RnIGS6vxRiZ4V0V+nuW:DNOsbkvchRoeKhQwkSqYGvnA6fiZojZ
TLSH
T1EDF47D1079C1C036E9B3147249FEA66A45ADF9320B2459DB93C80F7E5FB89D27E3121B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6e181a6e543b4581363400a61dfa7cd2739e9721243568d62c2a4637fac8e06.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4472	d6e181a6e543b4581363400a61dfa7cd2739e9721243568d62c2a4637fac8e06.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4472	d6e181a6e543b4581363400a61dfa7cd2739e9721243568d62c2a4637fac8e06.exe

C:\Users\Admin\AppData\Local\Temp\d6e181a6e543b4581363400a61dfa7cd2739e9721243568d62c2a4637fac8e06.exe
"C:\Users\Admin\AppData\Local\Temp\d6e181a6e543b4581363400a61dfa7cd2739e9721243568d62c2a4637fac8e06.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

launcher_config.ini

Path C:\Users\Admin\AppData\Local\Temp\launcher_config.ini
Size 348B
SHA256 cc03e87e7340af272ed58b04fff592afb9690a67c10e94b96ae6fdabf85dbfb6
MD5 2bdb907414b2f45f2d3979476fdb97a3
SHA1 7feb1da532f84ddd05cc9c439c6f0abe09ce3297
SHA512 34f3d08516d5229429e83f297723ce93a41e8c814c575978a3e0dab085aa21ad0d692df874392fe5836dda35d5d732b270a718b1e275f8dc317f208566dabea2
TLSH
T164E02D800E002942E076E4ACE8AB1FC0E0ABB00E88C15074FF2846DE1ABD43D12D8A03
MD5 SHA1 SHA512 TLSH

Submit Download