2349da51009ee3c888b68bab57d78de13fb1fbb2888bfeb02ed0c0c3504902d3

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 07:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
skate.exe
Size 983KB
Sample261110-jrmrdahv21
SHA256 2349da51009ee3c888b68bab57d78de13fb1fbb2888bfeb02ed0c0c3504902d3
MD5 409c0bd5580d615abdd435c229e4020b
SHA1 4ab2ff9602671dfb01623f4bd395dd3eb45e9f60
SHA512 d77142aae93c211ac4e7a1146ee096dbd74c6b1f7a6e4b3dfa484f17822009d9c352f1efd95213a19a0de4f89822667179b3ddc43e53d16c2cdbbfa1b4bf112f
SSDEEP 12288:sYbnCyZaBvAzl5ljjozXzTA4hHFy9K/4MXKPNIPhbQvQBPWrlZcBUcN4Mf:fCyQBvAzluzTJJFy9ZAC4slZxc5f
TLSH
T138257C53B7C3C1B1DFE214F3D5BA5A365939B8380B2C89CBB2D4582ED9A05C05B36B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skate.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3224	skate.exe
3224	skate.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3224	skate.exe
3224	skate.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3224	skate.exe

C:\Users\Admin\AppData\Local\Temp\skate.exe
"C:\Users\Admin\AppData\Local\Temp\skate.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.ini

Path C:\Users\Admin\AppData\Local\Temp\config.ini
Size 288B
SHA256 3586c081d7ff5d2e7295637e908b76a787bc7d08bd061b26b322edd1484be91f
MD5 f703e320cda1297a471c3de849c4787e
SHA1 aa00422575bb1d177a504248ec32f325fd99bd98
SHA512 754d9d70038de4be050f81b915ed0d77f35622373a603372b34f4a9f7e38c93b5f3433d2bd9752de7fc35aa563a6d4c4de2210cf8978c1dbdf5783a56132e998
TLSH
T1E6D0BC820BF20408F05AFA94BDFA18BB2733F76D3869C18914C50B0B55F168204137A7
MD5 SHA1 SHA512 TLSH

Submit Download