2c006915e7e558f854390f91861686704ac7813cf9e38970899e56f28fdd972f

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c006915e7e558f854390f91861686704ac7813cf9e38970899e56f28fdd972f.exe
Size 880KB
Sample261107-v5gm3afe29
SHA256 2c006915e7e558f854390f91861686704ac7813cf9e38970899e56f28fdd972f
MD5 88591e673a441c083123664ebd2851ca
SHA1 027c702640117515fa9614e13167a9ebde555901
SHA512 db0baca2b06822acb7c4deafc833cdb9afef538dbc4906387ebae1fc771930ae523e5488f144ca0e91bac3dae0cd91bf98e239a5df392aea32c36b1905da2f67
SSDEEP 1536:se5zFxFmo7wbQ7m62vrUI+MFF31+LHgcMnU3g7kYfPuu0e:RlFmoOQaJUI+MXFMPIUgk8z
TLSH
T1811523039E9AE71DEDA326349CF7C94C2EBAA41F9C2D822E0158C4353EF2570755D61E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c006915e7e558f854390f91861686704ac7813cf9e38970899e56f28fdd972f.exe

C:\Users\Admin\AppData\Local\Temp\2c006915e7e558f854390f91861686704ac7813cf9e38970899e56f28fdd972f.exe
"C:\Users\Admin\AppData\Local\Temp\2c006915e7e558f854390f91861686704ac7813cf9e38970899e56f28fdd972f.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4640-0-0x0000000000400000-0x00000000004E3000-memory.dmp

Download