0a8c31406cc5115e931a4213774c2b991666ddc1e5ae00741d79d2147974e1a7

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/09/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ThirdExploit.exe
Size 12KB
Sample260919-sdvphascjc
SHA256 0a8c31406cc5115e931a4213774c2b991666ddc1e5ae00741d79d2147974e1a7
MD5 8814085d8bfb52705e538acf4ba332d4
SHA1 bddfba32f9b06f93a912b25a6daff444cd91f00c
SHA512 2a1c73a935d7b2258dc2ff5e14684b43a0533bbed17e8ea108e3ce31f3ee5c1bf3d34dfb2c009cab7842abd7be4aac20a3817567eed492acb919d3293fcb8667
SSDEEP 192:3Cf+XxndPBwpjkTm6ssJpz6ZTd71wlH0cC:SM3PBzTlzY4ln
TLSH
T17F42A416A7FE8E11F5BA97701DB25200C633B9F19C39DB5E469C61190F2BB8069A0763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ThirdExploit.exe

C:\Users\Admin\AppData\Local\Temp\ThirdExploit.exe
"C:\Users\Admin\AppData\Local\Temp\ThirdExploit.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3120-0-0x0000000000700000-0x000000000070A000-memory.dmp

Download