2df8ec4029cf4368905a30258d76d7a24635d9bfbca20b0486f2840787b4111d

Analysis

max time kernel
149s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2df8ec4029cf4368905a30258d76d7a24635d9bfbca20b0486f2840787b4111d.exe
Size 1.1MB
Sample260820-thfxkstyf1
SHA256 2df8ec4029cf4368905a30258d76d7a24635d9bfbca20b0486f2840787b4111d
MD5 5d4e3be85d1e066312a4f44e405b448f
SHA1 49e49ff2ee25a2a41cc76a07b000aacedbb0f3e7
SHA512 011421b3d3bfee387b35e7fe7278be4a2273b21d30ac88a107ddeeaff954621fed7d906b973da1a99601283cce2d7d55c26a5d26d722f6f702f7c86219918b96
SSDEEP 24576:lZumCqwiAOc4vwKmptQlQpjsW0Wcws5F+6ClDZ0Fqk6+6xpRI+6Nrf/zEP:vtwi9vwKmptswj/0Wcwx8tQRre/E
TLSH
T1BE35CF13B6406072C49202719778B663A9B8B671073559C7F7CCA6A47FA0BE0AB3D74F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2df8ec4029cf4368905a30258d76d7a24635d9bfbca20b0486f2840787b4111d.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5384	2df8ec4029cf4368905a30258d76d7a24635d9bfbca20b0486f2840787b4111d.exe
5384	2df8ec4029cf4368905a30258d76d7a24635d9bfbca20b0486f2840787b4111d.exe
5384	2df8ec4029cf4368905a30258d76d7a24635d9bfbca20b0486f2840787b4111d.exe
5384	2df8ec4029cf4368905a30258d76d7a24635d9bfbca20b0486f2840787b4111d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	5384	2df8ec4029cf4368905a30258d76d7a24635d9bfbca20b0486f2840787b4111d.exe

C:\Users\Admin\AppData\Local\Temp\2df8ec4029cf4368905a30258d76d7a24635d9bfbca20b0486f2840787b4111d.exe
"C:\Users\Admin\AppData\Local\Temp\2df8ec4029cf4368905a30258d76d7a24635d9bfbca20b0486f2840787b4111d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5384-0-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/5384-1-0x0000000000400000-0x0000000000550000-memory.dmp

Download