3edbbf7e9c3d96ed796a311ef74227da8d918e5b79ba98257e433019b3133b87

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EAX Console.exe
Size 2.0MB
Sample261009-v5bf2sdb52
SHA256 3edbbf7e9c3d96ed796a311ef74227da8d918e5b79ba98257e433019b3133b87
MD5 a6b55ffd85c3405d3b80c1d465c1a37c
SHA1 09497080a7e79bc1e6c7d05da5f6c5e2516a933b
SHA512 cee8ad5a422c1e1b501bf7d91dfd61e476f124c85f926be966d5df494a2016ec3fa4c65a6e38dc362550170c9530890ca375c4cdd24ac59249d411fcfd2db224
SSDEEP 49152:RLsCK8uxgaMj3XRD+uj3H2Cuk1+Lda3Wvho0o5c0XWzoZsCKsmL:RLsCK80DMj3XZ+ujX2Cuk1+Lda3Wvhoy
TLSH
T1D89538D2EA4482D4ED3E47B3B1275CF116A33C7EEAF0649D248DB92649B3253442F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
508	4964	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EAX Console.exe

C:\Users\Admin\AppData\Local\Temp\EAX Console.exe
"C:\Users\Admin\AppData\Local\Temp\EAX Console.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 828
  2⤵
  - Program crash
  PID:508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4964 -ip 4964
1⤵
PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4964-0-0x0000000000640000-0x000000000083C000-memory.dmp

Download