beb7a17f415917488539b51d1bc69b2d2c96735cb2e5a428dc742a563fd38e1b

Analysis

max time kernel
141s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
16/07/2025, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
D695F85642D1F2F13D35586F047795DA.exe
Size 97.8MB
Sample250716-ynmpjaylv3
SHA256 beb7a17f415917488539b51d1bc69b2d2c96735cb2e5a428dc742a563fd38e1b
MD5 d695f85642d1f2f13d35586f047795da
SHA1 3c99c48cc8ef2ba336e4fb600d6f64c473059333
SHA512 796f06328859b7037fa98fec78b531af96bfd603ed503c94ef8437c6fe3e917a93b7bebfa867ea9960e76065b7309c5ab698fcd51e056c4525c5b6d758b2d0c5
SSDEEP 3145728:I5uAztc8IzKz6BjMc+20TQjh02HU2SwlwLnY:I+8SKzM8gC2HUpY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery upx

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1924	D695F85642D1F2F13D35586F047795DA.exe
1924	D695F85642D1F2F13D35586F047795DA.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1924-0-0x0000000000400000-0x00000000007DA000-memory.dmp	upx
behavioral2/memory/1924-80-0x0000000000400000-0x00000000007DA000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D695F85642D1F2F13D35586F047795DA.exe

C:\Users\Admin\AppData\Local\Temp\D695F85642D1F2F13D35586F047795DA.exe
"C:\Users\Admin\AppData\Local\Temp\D695F85642D1F2F13D35586F047795DA.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz853E.tmp\InstallOptions.dll
Size 15KB
SHA256 35895cc05a559c252a915cef70a15b425deadfbc41d5e83a04add37cb7d55d67
MD5 907d18654f6ee45ca28dcde4afa8a7b5
SHA1 cdc2ee050a1767337b007fc3c39f6cf0b7978fe8
SHA512 f476a9105e45e6a5e594054e4fab7f05a077608db44c4e1bb7e0a24a7b966a1d93e7515d1e86be239e027bee44e6bc4e3e3db96decf61e77415144ce7a2c49f1
SSDEEP 384:J38D9kETtmK0cNaajReCCiXqo5tXBNALmCVul:JykCtmK0cAaNeCCiXjXHNQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz853E.tmp\ioSpecial.ini
Size 1KB
SHA256 842b7d63ac100c094603ddc4f155499cf728643cc64410f78c545d272816cc5a
MD5 95157946adb168396ac186ee4005ece9
SHA1 aaf0c73867a6d43b2306a8d575cfbc674c029a05
SHA512 8524efa64d50e41314fb77af8d25f228280906d7539ee68d62b123d36a4b5e0acb55aff060ab78e93bd947009c682803777ddbc3376ee25ea934c25b46ccd8fb
MD5 SHA1 SHA512