48c7fd43b8625f812b00a4205fe0bc92c262c1e817457bacb79d8a3f75cf8825

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 14:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
48c7fd43b8625f812b00a4205fe0bc92c262c1e817457bacb79d8a3f75cf8825.exe
Size 1.5MB
Sample261017-r1wpmsfd92
SHA256 48c7fd43b8625f812b00a4205fe0bc92c262c1e817457bacb79d8a3f75cf8825
MD5 be96ae2a7a0dbb6368fd1c1157c9654a
SHA1 68a10f61be0720a4a7257e7f4596aa821f132494
SHA512 615e6f8a24707ea1e3e755c5fe29ed2445dd3d6060bc8bb536497fbb9487c5ada9670eb90feab3ef705a8dcc49cf3da94c81b47c6161ada54ee8881c17d963b8
SSDEEP 24576:e1duSBJFVu55azbb6WKRBxoYamrh6YxxUGDASz2si9bB:e1MjacxxbLzxiD
TLSH
T172756C23B10184A2E7151BB162B6433E6D3C57656A70CD83EBF0DDA9EC72173D36A21E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48c7fd43b8625f812b00a4205fe0bc92c262c1e817457bacb79d8a3f75cf8825.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3412	48c7fd43b8625f812b00a4205fe0bc92c262c1e817457bacb79d8a3f75cf8825.exe
3412	48c7fd43b8625f812b00a4205fe0bc92c262c1e817457bacb79d8a3f75cf8825.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3412	48c7fd43b8625f812b00a4205fe0bc92c262c1e817457bacb79d8a3f75cf8825.exe
3412	48c7fd43b8625f812b00a4205fe0bc92c262c1e817457bacb79d8a3f75cf8825.exe

C:\Users\Admin\AppData\Local\Temp\48c7fd43b8625f812b00a4205fe0bc92c262c1e817457bacb79d8a3f75cf8825.exe
"C:\Users\Admin\AppData\Local\Temp\48c7fd43b8625f812b00a4205fe0bc92c262c1e817457bacb79d8a3f75cf8825.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads