d9e2c3d64a11c1695a0e4414a272bf72f0926d76cdb0de51220664592f740ccf

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9e2c3d64a11c1695a0e4414a272bf72f0926d76cdb0de51220664592f740ccf.exe
Size 521KB
Sample261101-grsarabd62
SHA256 d9e2c3d64a11c1695a0e4414a272bf72f0926d76cdb0de51220664592f740ccf
MD5 c092e2f122c5ca4e856260c3eb627d14
SHA1 3a04a80f28085f9d9250c47ab825f91fde1dfb4e
SHA512 4a4f035c725cfea728453ce8dc24e03c16326291f9645a1f364470979f9d24df20b11b31bda84145f9ad4ea33b8ece0372517d2deeb84bf538cc916161b3ee10
SSDEEP 6144:iTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZXAXkcr3T4:iTlrYw1RUh3NFn+N5WfIQIjbs/ZXgT4
TLSH
T1E8B49E01BAD1C072D97514300D3AF776EAB8BD201835497B73EA1D5BFE31190A72AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1764	3968	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9e2c3d64a11c1695a0e4414a272bf72f0926d76cdb0de51220664592f740ccf.exe

C:\Users\Admin\AppData\Local\Temp\d9e2c3d64a11c1695a0e4414a272bf72f0926d76cdb0de51220664592f740ccf.exe
"C:\Users\Admin\AppData\Local\Temp\d9e2c3d64a11c1695a0e4414a272bf72f0926d76cdb0de51220664592f740ccf.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 660
  2⤵
  - Program crash
  PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3968 -ip 3968
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads