5470b46868b245f79230e6f126e8b4a8383322d7894e8b84eb4f1e5363ccb3f1

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5470b46868b245f79230e6f126e8b4a8383322d7894e8b84eb4f1e5363ccb3f1.exe
Size 745KB
Sample261107-v684psfe43
SHA256 5470b46868b245f79230e6f126e8b4a8383322d7894e8b84eb4f1e5363ccb3f1
MD5 b98abc5fb1d80eaab332b0fa1dea0fc0
SHA1 5a0ac2408a2557624e7efce429f6a97e786cc582
SHA512 648afb13182bb830cfda35ed2a2cea02b519fd5fbaccc46077c6e8b8b068577863b2a21c505b2770ea17f15b21b18e89f3015231fcc1405b3ea0e1461ad2826c
SSDEEP 6144:cc6mgmSua4k0Kvn/FHStHbQwqlCUpfSfjL94Qdb4QzvAxk:Z4oAZnk
TLSH
T191F48405ABFA9616F5F36B306DB587A90A3AFC50AD31C70F9B44210E5831B14DFA1B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5470b46868b245f79230e6f126e8b4a8383322d7894e8b84eb4f1e5363ccb3f1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2692	5470b46868b245f79230e6f126e8b4a8383322d7894e8b84eb4f1e5363ccb3f1.exe

C:\Users\Admin\AppData\Local\Temp\5470b46868b245f79230e6f126e8b4a8383322d7894e8b84eb4f1e5363ccb3f1.exe
"C:\Users\Admin\AppData\Local\Temp\5470b46868b245f79230e6f126e8b4a8383322d7894e8b84eb4f1e5363ccb3f1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2692-0-0x000000000041E000-0x000000000041F000-memory.dmp

Download

memory/2692-1-0x0000000000400000-0x00000000004C2000-memory.dmp