Overview
overview
8Static
static
7assistance...ue.exe
windows10-2004-x64
4assistance...ue.exe
windows11-21h2-x64
4$PLUGINSDI...64.dll
windows10-2004-x64
3$PLUGINSDI...64.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-21h2-x64
3$PLUGINSDI...rb.dll
windows10-2004-x64
3$PLUGINSDI...rb.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows11-21h2-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows11-21h2-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-21h2-x64
3$PLUGINSDI...ay.dll
windows10-2004-x64
5$PLUGINSDI...ay.dll
windows11-21h2-x64
5$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3TeamViewer.exe
windows10-2004-x64
8TeamViewer.exe
windows11-21h2-x64
7Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/04/2026, 00:18
Behavioral task
behavioral1
Sample
assistance-informatique.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
assistance-informatique.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Base64.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Base64.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InvokeShellVerb.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InvokeShellVerb.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/UAC.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsArray.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsArray.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
TeamViewer.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
TeamViewer.exe
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target assistance-informatique.exe
- Size 9.5MB
- Sample260422-als7jaev9p
- SHA256 1b82576d3240f7a22a1f863a4bb51e06192d65b740edfc4afe457f85a3bf8e30
- MD5 724e1266835113707511fa2a7086dc05
- SHA1 4c0d7b30adf3a5c0e4f7c6b532094b77b8a7d601
- SHA512 6820a8c253dddd9b4be05b4d4d4446dcff4a435e45f022cea20924b965ec6eb369048a3d95cde52718cd349800d81d41628c8b93a60c937f22116b6bd3677980
- SSDEEP 196608:u5Y3e2KVJ8//UC22xQxKJ0uLB4pPsJONVo/HugxRfJI8q0Wxx:FHgC/sCpkKJ0uN4nNVo/ugrfJiDx
- TLSH T1F8A6332B3468C544D81F08B2CC99E1F0307F6D59EDA6978BA5973F49B2327A7107E90B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 20 IoCs
pid Process 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe 2716 assistance-informatique.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language assistance-informatique.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsa5E4A.tmp\InstallOptions.dll
- Size 15KB
- SHA256 d239e6ca779f822e2f28ef9a86bdbbd7a5ea9c7641b7a62a37c9b45b15dc5c8a
- MD5 44a147533d1439c7b6ef37e2153e3c00
- SHA1 1f7c3bce46180b1e791b8fc27f576c8c39881e18
- SHA512 85380b45fcc3803c38b9092ed5f310c80390bb40502f2d09599922f0db03b4ea44c7a8c9ddb5ce9d0b6a95c54ae3d79cb58609b197f64f383dacb931c38fd482
- SSDEEP 384:ECC43tPegZ3eBaRwCPOYY7nNYXCm/Yosa:ELTgZ3eBTCmrnNAC
- TLSH T127624D1137D558B3E2D62A797EE2B7138FA5FB2264438E0BC7332E06381A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa5E4A.tmp\System.dll
- Size 11KB
- SHA256 e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27
- MD5 ee260c45e97b62a5e42f17460d406068
- SHA1 df35f6300a03c4d3d3bd69752574426296b78695
- SHA512 a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3
- SSDEEP 192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
- TLSH T10C325C02135081F3E4918138986B3A276B6A15029BF98E57DFD39646BE20BE3BD3D603
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa5E4A.tmp\TvGetVersion.dll
- Size 153KB
- SHA256 01abf435f6dcc89560a068a9af0c2e6f067d7d4b1a6a0b848b40ecb907885d11
- MD5 d2c761a29981f8469a4c3071db73cd02
- SHA1 7e3fa24665b4ddd615dbc2e9b07dd73595836930
- SHA512 420e33d24da8392037a3afd413df96cc650b5c5a25de1e10d0859cf926b149a77197bbcd59313b0a96e115add4c7ad7fe712a6d14bb072cb46eb6bd62a1d369c
- SSDEEP 3072:Tyht+x43dp/t1/kZfj1SvXTmj0OslQaG5Ewyi:eExEXt1Cb1SEslQavw
- TLSH T1C9E31A1137F08039F5F72A786CF5C6604E7ABD32AA30D25EE750C96A2970B85DA35327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa5E4A.tmp\UserInfo.dll
- Size 4KB
- SHA256 2071ad3c37ddc62c9fdbca7e2551d16bee11b0ef0f510cd16ddc098cd368fbc1
- MD5 352495269f7d223991247cd2f2eec4db
- SHA1 22a4aae719ba575c7b90524595a1eac500c2209f
- SHA512 07005457d0f76fbb412dbbf094460020b486ebd073446265f252226f52e4705d95a0d05a1f32a39c6f3bd3a9853be837e9425360341581ebf36493939c629608
- TLSH T1708160BBA3F40CB2C0854BBB40A71CA793B2DD702716401E498B568A2084A6FED1E705
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa5E4A.tmp\environment_unicode.ini
- Size 1KB
- SHA256 0412a1be7aef49060bbaf0cd8620c09c8035cd198fae5220c670b980a2979b17
- MD5 231839edd338a5d1a2786a724f3ac537
- SHA1 6c1c3455df3347042dba9c85728e5a8761e69036
- SHA512 e8cf431127a5f6ee1094391d2e6b518887f693e95c8b449a91cca8fa7015317384ba7cee4954faa97f60b352e226eead3e4461683e348bfcbd5363f0a767a091
- TLSH T1622151533BF80144E5BBF619EBF68036A7393906183DC91E80D10B0E49E5680426BBDB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa5E4A.tmp\environment_unicode.ini
- Size 1KB
- SHA256 d544eccf3e20d02d73ba2c26e61ce68f33e6fb7b0e101e1714683a00c94a1916
- MD5 514953ff019bf3cc56840a35b68ada1f
- SHA1 7bff894a7dc79e76ac6211b41140dac76ca7060b
- SHA512 438f5946683a44a8ea670d147811475f964991cd5050384b3ddd9e7bf501e1cd74f82dcf896eedaec65d9ee0ba40b00a080f154469e623a394e863b526b43f7d
- TLSH T1A62172633FF80158E5BBF619EBF58036A7393902583DC91E90D10B4E49F6A40466BBDB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa5E4A.tmp\hoststart_unicode.ini
- Size 1KB
- SHA256 133387e87f0e0a06f76ca59a6d1745e21a860bef832e677e08fd1fe4d75962bd
- MD5 39df91d980d845d48188dd425312bd87
- SHA1 c781926eb99dfad1c74d8325fe4b270348ce3c6f
- SHA512 89e3777a0d1b7038b073f47f13f0319b2b39385c933c07cdd266b4c5eddc0915ab9ac8a9556bf48cccf8a8b7a204b85dd02d09a0e56cf3c4c20052af8b4e2d73
- TLSH T1602175532BE80118F2F3AF69EAF200718B757C569C3CD98D41C10A0E44F5D80E876BAB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa5E4A.tmp\hoststart_unicode.ini
- Size 1KB
- SHA256 032763c21d1b54ff8ce9bc6c95d31cd979db8ea7a0f4f4f41133e3b2e2f19153
- MD5 ba76dd19885ca795c0e0ccb6804cc4dc
- SHA1 bd5ecba5ac0d31367c802fdb50ccf3d907ed9d26
- SHA512 e6cdcb31ca5fe583d1091eaada3cb213117e08f5fbef96481d93cbee804740e7560173b36fb826c84dd97491eee131c4c590090a418480c03db2186f6cefc5cc
- TLSH T1682187522BF80118F2F3AF69EAF100718B757C569C3CD98D01C10A0E44F4D80E876BAB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa5E4A.tmp\vpn_unicode.ini
- Size 1KB
- SHA256 f2c2534724376dbc31c9090174d391db9cd5caff9063986d3ef144c644200ee1
- MD5 c9575d8b896460e30f0abc8f1e0371d4
- SHA1 bb29760bd0dc2fe3a549aa094838f40f0db7759e
- SHA512 e271f0f65335b0c0fcc03961efc94ddd11d1e8428d18a339ac73fc2c96d2e4b0db68bab7d22c851622c4544cc5d9c5b5abf597c92b57134254e6fe5c02ef2d03
- TLSH T15541A0036BF94108F5FBBB54EAF541358B7A3C95993CC14E40D1094E05F5AC099677EB
- MD5 SHA1 SHA512 TLSH