Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 10:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c5e30354bf1af331150c5d6593ae286f71840e83f32cea852f40a3a1ee21d4bf.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
c5e30354bf1af331150c5d6593ae286f71840e83f32cea852f40a3a1ee21d4bf.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target c5e30354bf1af331150c5d6593ae286f71840e83f32cea852f40a3a1ee21d4bf.exe
- Size 71KB
- Sample260916-mccjmsyeng
- SHA256 c5e30354bf1af331150c5d6593ae286f71840e83f32cea852f40a3a1ee21d4bf
- MD5 6ddb932167271185978518a0c13dfa44
- SHA1 35eb0b274ff9217e636d76688a72be7dc62c3655
- SHA512 f4281dc30d645b07033743676ad96eeae717186d31bf17ad8555702a446a4131d8342163c240d5de39322836fa6a312c9e3404f23006df75b06f88f6de3ae924
- SSDEEP 768:r90+rLGRHHf+LKXdKu+nrOmzby2EM0Uyyyyhyyy+yyZUyyvMt0w9Y2n3yI9gbpee:pNwz+aecK9Zgbp3zuE
- TLSH T17263B711EFEACA2AFDF216342D7F8455077AF815FDB2870F774040089AB266487A671E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c5e30354bf1af331150c5d6593ae286f71840e83f32cea852f40a3a1ee21d4bf.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2784 c5e30354bf1af331150c5d6593ae286f71840e83f32cea852f40a3a1ee21d4bf.exe 2784 c5e30354bf1af331150c5d6593ae286f71840e83f32cea852f40a3a1ee21d4bf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5e30354bf1af331150c5d6593ae286f71840e83f32cea852f40a3a1ee21d4bf.exe"C:\Users\Admin\AppData\Local\Temp\c5e30354bf1af331150c5d6593ae286f71840e83f32cea852f40a3a1ee21d4bf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2784