bafa73bd69fb861a8f5ebbfefde6d8368465f4ff2944fbb8ce8ec68f65694357

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bafa73bd69fb861a8f5ebbfefde6d8368465f4ff2944fbb8ce8ec68f65694357.exe
Size 514KB
Sample261102-jp3ptaat5m
SHA256 bafa73bd69fb861a8f5ebbfefde6d8368465f4ff2944fbb8ce8ec68f65694357
MD5 23370f703612cd9887c28901b2452865
SHA1 8e7c23225f0463cae4110a6dd05687de9b9f2a51
SHA512 daf8b2526c7ed4c1697e47c716222a0b67674203f3e7efd13fa612a8822b7ce26d1457cb80a871b83595f292262eaf8b2f7fadb18d5be81925e80b1b32ff3a96
SSDEEP 12288:Z0lDmBRGWAOLV9/0N34sxl2SnR3XtynqD:WlDWRGaLr8N34sxl2SnR3XtynqD
TLSH
T140B44A84EAC365F3ED474A7081A7F7BFAB349600C075CE75CA5CD994ED63A33512A228
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bafa73bd69fb861a8f5ebbfefde6d8368465f4ff2944fbb8ce8ec68f65694357.exe

C:\Users\Admin\AppData\Local\Temp\bafa73bd69fb861a8f5ebbfefde6d8368465f4ff2944fbb8ce8ec68f65694357.exe
"C:\Users\Admin\AppData\Local\Temp\bafa73bd69fb861a8f5ebbfefde6d8368465f4ff2944fbb8ce8ec68f65694357.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5700-0-0x0000000000400000-0x0000000000485000-memory.dmp

Download