b5887947e69c0256c49197c4923cd5898c7e07b81a210ca10dce6940fb9dd39e

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b5887947e69c0256c49197c4923cd5898c7e07b81a210ca10dce6940fb9dd39e.exe
Size 275KB
Sample260831-ebblysee72
SHA256 b5887947e69c0256c49197c4923cd5898c7e07b81a210ca10dce6940fb9dd39e
MD5 7dc0e0912c12c296990f164ecf533d13
SHA1 9262f0b3a559044a0904a402b143b9dc9cb4847e
SHA512 a53b8ebc57383d1b1aad92c187068611112af2984688c187495dfc3b202cfe7c2015381f2d3c639d95ffbe8ee77a8f2c797c227769c8fda98a2f8dcdf6c24f00
SSDEEP 3072:ZAyL9W0ElYKXeMuftffjmNAL4KIFmFTYGRMlTHFMaJ6Fx39fHYToD:PL5EjOMWVfjmNAL4WTYaMlDFMLpgT
TLSH
T102549E4673D098FAD06645B8DCA68219E372BC220A39475F36AC3F5E5F773821E2D352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5887947e69c0256c49197c4923cd5898c7e07b81a210ca10dce6940fb9dd39e.exe

C:\Users\Admin\AppData\Local\Temp\b5887947e69c0256c49197c4923cd5898c7e07b81a210ca10dce6940fb9dd39e.exe
"C:\Users\Admin\AppData\Local\Temp\b5887947e69c0256c49197c4923cd5898c7e07b81a210ca10dce6940fb9dd39e.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5864-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5864-1-0x0000000000400000-0x0000000000435000-memory.dmp