Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/08/2026, 10:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
348cb47f1bb032e558a2243233216c23e4ba43c5114676864f663fc3c46e2fca.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
348cb47f1bb032e558a2243233216c23e4ba43c5114676864f663fc3c46e2fca.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 348cb47f1bb032e558a2243233216c23e4ba43c5114676864f663fc3c46e2fca.exe
- Size 773KB
- Sample260831-men1fszdpc
- SHA256 348cb47f1bb032e558a2243233216c23e4ba43c5114676864f663fc3c46e2fca
- MD5 c2ee336dfe973f2b4bb92b96cc4b4c48
- SHA1 ae07fd1a87eeb284aa787e030c7d8f11c1a1acad
- SHA512 20024885df87f091e39ceeadfeef50be99fd3c7abcf5be17cd1c9b4513a46f103f5988a6e73462fa2f7918289520a37a4bb62318ea8c72b962291d9c2b922a86
- SSDEEP 6144:W/c1Cgf1b3j5r8oVbol/ax+Nb7561gAOZ1ucyzcy:W/cZ9Lj5Io8/axpgxhyzcy
- TLSH T1E1F4C043A70BA1ED966C512A726C0B30D3C46C179E122CFEFFB14654591FBC31AE6CA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 348cb47f1bb032e558a2243233216c23e4ba43c5114676864f663fc3c46e2fca.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4848 348cb47f1bb032e558a2243233216c23e4ba43c5114676864f663fc3c46e2fca.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4848 348cb47f1bb032e558a2243233216c23e4ba43c5114676864f663fc3c46e2fca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\348cb47f1bb032e558a2243233216c23e4ba43c5114676864f663fc3c46e2fca.exe"C:\Users\Admin\AppData\Local\Temp\348cb47f1bb032e558a2243233216c23e4ba43c5114676864f663fc3c46e2fca.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4848
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\launcher_config.ini
- Size 348B
- SHA256 938df7a6c7ebaa60cf0cd6de9299f550f61d6208601c8067eb4b0b7f975965c9
- MD5 e3bed1ee0f3d384f4205e13e8d2c13a5
- SHA1 32d5737458eae7fe3026ccc569376c6ca7d8b6ec
- SHA512 d339595cc97aa92589b0813eacab7916687d45b2e422f1561676f89b0033050fbe508301e2000c68bfca4f73f9597608094467f389796b31e754e9b9f1e326d9
- TLSH T14BE02D800E002402E076E0A8E8B72BC1E0AAB00A88C15074FF3846DE1ABE43C02D8A07
- MD5 SHA1 SHA512 TLSH