916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
Size 2.3MB
Sample260820-p4pdmaxdrg
SHA256 916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6
MD5 982821f3fe8006c6bed4933bdd654a5f
SHA1 a8a0be4ffa83de498e9610a3a315df04d7f5a432
SHA512 4568147fc1312c0db97ff43cb216a9642efc0d1f7cddc326e4ab058d104ace204e10cb805848b7a41aaf4a2aab31da2aeef1bf8a806f39fa0a33a12a3f96ee81
SSDEEP 49152:QeaAsJDiM/hmLSnyXTg5oJSkOWOxXPhmL2QmGThYD:QeaDBiMZmLtDXJexpmL7m
TLSH
T1FFB5BF02FF8284B1F5D3057561AB5B7F8D39AA202328C5D3D7D119799D302D2BA3E39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
2832	916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe

C:\Users\Admin\AppData\Local\Temp\916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe
"C:\Users\Admin\AppData\Local\Temp\916f05fdc1b1d20ed5365c4d60a1e00253ef78d1bee58ba241e65c190fe3c3c6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2832-0-0x0000000000580000-0x00000000007D7000-memory.dmp

Download

memory/2832-1-0x0000000000580000-0x00000000007D7000-memory.dmp

Download