Overview
overview
8Static
static
7assistance...ue.exe
windows10-2004-x64
4assistance...ue.exe
windows11-21h2-x64
4$PLUGINSDI...64.dll
windows10-2004-x64
3$PLUGINSDI...64.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-21h2-x64
3$PLUGINSDI...rb.dll
windows10-2004-x64
3$PLUGINSDI...rb.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows11-21h2-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows11-21h2-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-21h2-x64
3$PLUGINSDI...ay.dll
windows10-2004-x64
5$PLUGINSDI...ay.dll
windows11-21h2-x64
5$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3TeamViewer.exe
windows10-2004-x64
8TeamViewer.exe
windows11-21h2-x64
7Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/04/2026, 00:18
Behavioral task
behavioral1
Sample
assistance-informatique.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
assistance-informatique.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Base64.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Base64.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InvokeShellVerb.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InvokeShellVerb.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/UAC.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsArray.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsArray.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
TeamViewer.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
TeamViewer.exe
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target assistance-informatique.exe
- Size 9.5MB
- Sample260422-als7jaev9p
- SHA256 1b82576d3240f7a22a1f863a4bb51e06192d65b740edfc4afe457f85a3bf8e30
- MD5 724e1266835113707511fa2a7086dc05
- SHA1 4c0d7b30adf3a5c0e4f7c6b532094b77b8a7d601
- SHA512 6820a8c253dddd9b4be05b4d4d4446dcff4a435e45f022cea20924b965ec6eb369048a3d95cde52718cd349800d81d41628c8b93a60c937f22116b6bd3677980
- SSDEEP 196608:u5Y3e2KVJ8//UC22xQxKJ0uLB4pPsJONVo/HugxRfJI8q0Wxx:FHgC/sCpkKJ0uN4nNVo/ugrfJiDx
- TLSH T1F8A6332B3468C544D81F08B2CC99E1F0307F6D59EDA6978BA5973F49B2327A7107E90B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 20 IoCs
pid Process 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe 4868 assistance-informatique.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language assistance-informatique.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsm2F1C.tmp\InstallOptions.dll
- Size 15KB
- SHA256 d239e6ca779f822e2f28ef9a86bdbbd7a5ea9c7641b7a62a37c9b45b15dc5c8a
- MD5 44a147533d1439c7b6ef37e2153e3c00
- SHA1 1f7c3bce46180b1e791b8fc27f576c8c39881e18
- SHA512 85380b45fcc3803c38b9092ed5f310c80390bb40502f2d09599922f0db03b4ea44c7a8c9ddb5ce9d0b6a95c54ae3d79cb58609b197f64f383dacb931c38fd482
- SSDEEP 384:ECC43tPegZ3eBaRwCPOYY7nNYXCm/Yosa:ELTgZ3eBTCmrnNAC
- TLSH T127624D1137D558B3E2D62A797EE2B7138FA5FB2264438E0BC7332E06381A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm2F1C.tmp\System.dll
- Size 11KB
- SHA256 e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27
- MD5 ee260c45e97b62a5e42f17460d406068
- SHA1 df35f6300a03c4d3d3bd69752574426296b78695
- SHA512 a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3
- SSDEEP 192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
- TLSH T10C325C02135081F3E4918138986B3A276B6A15029BF98E57DFD39646BE20BE3BD3D603
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm2F1C.tmp\TvGetVersion.dll
- Size 153KB
- SHA256 01abf435f6dcc89560a068a9af0c2e6f067d7d4b1a6a0b848b40ecb907885d11
- MD5 d2c761a29981f8469a4c3071db73cd02
- SHA1 7e3fa24665b4ddd615dbc2e9b07dd73595836930
- SHA512 420e33d24da8392037a3afd413df96cc650b5c5a25de1e10d0859cf926b149a77197bbcd59313b0a96e115add4c7ad7fe712a6d14bb072cb46eb6bd62a1d369c
- SSDEEP 3072:Tyht+x43dp/t1/kZfj1SvXTmj0OslQaG5Ewyi:eExEXt1Cb1SEslQavw
- TLSH T1C9E31A1137F08039F5F72A786CF5C6604E7ABD32AA30D25EE750C96A2970B85DA35327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm2F1C.tmp\UserInfo.dll
- Size 4KB
- SHA256 2071ad3c37ddc62c9fdbca7e2551d16bee11b0ef0f510cd16ddc098cd368fbc1
- MD5 352495269f7d223991247cd2f2eec4db
- SHA1 22a4aae719ba575c7b90524595a1eac500c2209f
- SHA512 07005457d0f76fbb412dbbf094460020b486ebd073446265f252226f52e4705d95a0d05a1f32a39c6f3bd3a9853be837e9425360341581ebf36493939c629608
- TLSH T1708160BBA3F40CB2C0854BBB40A71CA793B2DD702716401E498B568A2084A6FED1E705
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm2F1C.tmp\environment_unicode.ini
- Size 1KB
- SHA256 0412a1be7aef49060bbaf0cd8620c09c8035cd198fae5220c670b980a2979b17
- MD5 231839edd338a5d1a2786a724f3ac537
- SHA1 6c1c3455df3347042dba9c85728e5a8761e69036
- SHA512 e8cf431127a5f6ee1094391d2e6b518887f693e95c8b449a91cca8fa7015317384ba7cee4954faa97f60b352e226eead3e4461683e348bfcbd5363f0a767a091
- TLSH T1622151533BF80144E5BBF619EBF68036A7393906183DC91E80D10B0E49E5680426BBDB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm2F1C.tmp\hoststart_unicode.ini
- Size 1KB
- SHA256 6b62187506d9ec384f054513ce117c4f5cbd78e5d08c83f8b9bf1bc5fdbbc70f
- MD5 331efaf68cab56ad42fba1a0c98c6af6
- SHA1 1ebac723d326b5bf691844bde293be583e1d1696
- SHA512 1fee551398982fb80bb5d0aaa9c3272b16df92eb798ed3351fd4a1aa0a3d169ad29c4b1e6a727ac56a5ea8d6b7b977e21c2dbce1c73ce446561a284941c8e90e
- TLSH T1A821784227E80118F2F3AF69EAF100718B757C566C3CD58D41C10A0E45F9D80E876BAB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm2F1C.tmp\hoststart_unicode.ini
- Size 1KB
- SHA256 f1f8ed0a21155c3914109cf7ecac0dba254e2ac21dcdfcad49e9fcdab871f5f2
- MD5 82b541d544a76608c4b959a192bb13a4
- SHA1 aa17fd6706e16820d05c855ce4b0cfd8040f6113
- SHA512 87096ba5f6b744ff91990cbd6a2950944bb5495a258d1419c46d75aacda99213af78ce9b7037a79440a5175c3af0c9d1adf8877085bf8f33b3b6b0a49664e5f5
- TLSH T1A521685227F80118F6F76F69EAF100718B757C565C3CD58D41C10A0E45F8D80E876BAB
- MD5 SHA1 SHA512 TLSH