87e23d4d12e3fd2867114b736fc2b19be2dcce0dda56bffc4dfbd08c58cb19b9

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87e23d4d12e3fd2867114b736fc2b19be2dcce0dda56bffc4dfbd08c58cb19b9.exe
Size 96KB
Sample260906-137dlatdng
SHA256 87e23d4d12e3fd2867114b736fc2b19be2dcce0dda56bffc4dfbd08c58cb19b9
MD5 81961f15e2afa78e51c46e4e41721e68
SHA1 e0f27ad41f4b4ff74e662b1143cdf4fc77d7f44d
SHA512 ccf1af52e05139c9232036ec23f2d88ae9e672f9786fdc91984f1b716a5f3a35bb86325d9d06be08749ba387f5aadd1bde55f4f8404988a554b6a06371bbf173
SSDEEP 384:IWQqCGSSmHqgz+zhFxtRSXX54S8ofw00RzwqwAfJnOEmnHEB2tTWRlXKkzqGAnD:IWgHqNqXm0UZmHtTYz6
TLSH
T191A353D177A56892FA72663D55FA83212B3CFBE0CAE25707890477265D239D02CD333A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87e23d4d12e3fd2867114b736fc2b19be2dcce0dda56bffc4dfbd08c58cb19b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 3448	2836	87e23d4d12e3fd2867114b736fc2b19be2dcce0dda56bffc4dfbd08c58cb19b9.exe	88

C:\Users\Admin\AppData\Local\Temp\87e23d4d12e3fd2867114b736fc2b19be2dcce0dda56bffc4dfbd08c58cb19b9.exe
"C:\Users\Admin\AppData\Local\Temp\87e23d4d12e3fd2867114b736fc2b19be2dcce0dda56bffc4dfbd08c58cb19b9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2836-0-0x0000000000830000-0x0000000000843000-memory.dmp

Download