ef8b45213f69d3cf2e4f231b96ba5153d8ea6707123c1be999594d91e27d0a02

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef8b45213f69d3cf2e4f231b96ba5153d8ea6707123c1be999594d91e27d0a02.exe
Size 560KB
Sample261002-2g4agsvarg
SHA256 ef8b45213f69d3cf2e4f231b96ba5153d8ea6707123c1be999594d91e27d0a02
MD5 ffa1d8619fe22887007ae06d0303f413
SHA1 7f26d4a46b0cab5d0e8a8afbb544b54785653dfa
SHA512 c9cfda9884c311077fed9e62cdc96adee7ed59882a9fa479d8dc529704cedbe33b3e8bd0d6fe5cad69b3ae319e04be871b4c06c663e2974df64b65db5e41825d
SSDEEP 12288:tuX98Pw1GOnvCbwN17XnBNdBlZRC13c+KQ/mYTpyZ8+dvuletGTgDs3oW9BtVnKb:tuX9807XXdBlZqLHwT
TLSH
T1CBC4A11AA715B02DF146B0B33528A677242A2CF71580A9CBF3F04E6528721D76DF9B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef8b45213f69d3cf2e4f231b96ba5153d8ea6707123c1be999594d91e27d0a02.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2572	ef8b45213f69d3cf2e4f231b96ba5153d8ea6707123c1be999594d91e27d0a02.exe

C:\Users\Admin\AppData\Local\Temp\ef8b45213f69d3cf2e4f231b96ba5153d8ea6707123c1be999594d91e27d0a02.exe
"C:\Users\Admin\AppData\Local\Temp\ef8b45213f69d3cf2e4f231b96ba5153d8ea6707123c1be999594d91e27d0a02.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2572-0-0x0000000000400000-0x000000000048F000-memory.dmp

Download