611892682cba79ff5307341725b4c39afc55d60aea7c82e53b8aa6975d85f79e

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
openvpn-gui.exe
Size 979KB
Sample261113-bl4hyaes7w
SHA256 611892682cba79ff5307341725b4c39afc55d60aea7c82e53b8aa6975d85f79e
MD5 3b2758bcd8a20d3668893250aa7ed135
SHA1 14b42b6b4ef9a5d20e8a123ec5612949a6461ed5
SHA512 4084777165c61d0a1abe6ce5e69f3e5c2e9e663fdce5663eba210f5e4fe5d5d1be73332362fa4faaa6b7c507181e1f6bbff06c085b746e59c0035a1c1aa97e89
SSDEEP 12288:HkuJyScjDQlk/xtpmUgQHCii7SFvQv5tmUi4N38:mLdFCii7SFoj
TLSH
T1EC257F01B3FA8114F1F36B759DBA4AA25E3BBC915E30C98F6295315E1972E90D930B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openvpn-gui.exe

C:\Users\Admin\AppData\Local\Temp\openvpn-gui.exe
"C:\Users\Admin\AppData\Local\Temp\openvpn-gui.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads