Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/09/2026, 22:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
56113917e992345a9c1c36db1a83ba8f3666bc8a9e1fc5894c75fe9db41cd0d7.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
56113917e992345a9c1c36db1a83ba8f3666bc8a9e1fc5894c75fe9db41cd0d7.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 56113917e992345a9c1c36db1a83ba8f3666bc8a9e1fc5894c75fe9db41cd0d7.exe
- Size 156KB
- Sample260906-17vwcstemb
- SHA256 56113917e992345a9c1c36db1a83ba8f3666bc8a9e1fc5894c75fe9db41cd0d7
- MD5 1edf6c2f05ea376f5cdd85bb5f764f2c
- SHA1 c3ed3714795124dc6cd0d5acf28baef8e19b791a
- SHA512 777b742a915bdc8da618da21a07abce38cf28c1fe3bc115deed426d651a40e86c3ef5cb40031f5092b2637aa9155b14d843e6f88982eac6c546e41e011b6b6e0
- SSDEEP 3072:1nVon7dzdRdWkmE8ed/H76PK6nDzyTFvgUKkSKXZf32NDmxIZqYDnGqMi5JdsVGP:EP7DTTF2
- TLSH T18AF3D780F665B48FE5769B3D09D9931133F9B7A1976BA70B45083F354D23BC02E9232A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56113917e992345a9c1c36db1a83ba8f3666bc8a9e1fc5894c75fe9db41cd0d7.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4316 56113917e992345a9c1c36db1a83ba8f3666bc8a9e1fc5894c75fe9db41cd0d7.exe 4316 56113917e992345a9c1c36db1a83ba8f3666bc8a9e1fc5894c75fe9db41cd0d7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56113917e992345a9c1c36db1a83ba8f3666bc8a9e1fc5894c75fe9db41cd0d7.exe"C:\Users\Admin\AppData\Local\Temp\56113917e992345a9c1c36db1a83ba8f3666bc8a9e1fc5894c75fe9db41cd0d7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4316