c495738a7d385d5ec64b916ee8d23801af485e53fcfdc43f45c29d7898429a5a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c495738a7d385d5ec64b916ee8d23801af485e53fcfdc43f45c29d7898429a5a.exe
Size 250KB
Sample260916-mfd7mswzes
SHA256 c495738a7d385d5ec64b916ee8d23801af485e53fcfdc43f45c29d7898429a5a
MD5 f6eab9020e4f45ac1b93b19d027eb614
SHA1 b5d8cbe485fa73e6468c2feb5db4dc0353532a99
SHA512 f7d571c12dc14240c605abbecc65c51aea03e2e4d4ed2dac7d0c1e5bc7566a37e6eb8ea6b76e7f55e97b9616ba8943f2b672b01ef990d2623b210396954f2db2
SSDEEP 6144:cJKoE/Sjq/dxFDb+ReYXoVGT5sPHMEWGfgGetPN5/P/3N8QAy+L7d96LU/cvvFEa:cJTwENV
TLSH
T1CA44BA1C96EA0705F6B32B3569F641054B7BB955EDF0CB0E218D911E1BE7A00E9BCF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c495738a7d385d5ec64b916ee8d23801af485e53fcfdc43f45c29d7898429a5a.exe

C:\Users\Admin\AppData\Local\Temp\c495738a7d385d5ec64b916ee8d23801af485e53fcfdc43f45c29d7898429a5a.exe
"C:\Users\Admin\AppData\Local\Temp\c495738a7d385d5ec64b916ee8d23801af485e53fcfdc43f45c29d7898429a5a.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4808-0-0x0000000000400000-0x0000000000446000-memory.dmp

Download