8db87a458551371e911bea5243840c783b5e7d41b7f867a2a6f74971881fb1e4

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
npp.8.9.3.Installer.x64.exe
Size 6.6MB
Sample260424-kyaaases7p
SHA256 8db87a458551371e911bea5243840c783b5e7d41b7f867a2a6f74971881fb1e4
MD5 3419ce845525534cda48cf6959bc41c5
SHA1 32d5f6f3ae0354dbd44afbaf99bfd1d3977668d2
SHA512 f0016b08ff63855e12ff3418909086041e456271fa3e0883c52088f48aa9be13bd0d028c35abc994ce8816009594ca875bfd349757b83f160969cb7c41070440
SSDEEP 98304:CQvozTSOU7wEDKJ1acuNX/PjhJ4LWuBr88glx2tDvDBPWMfUqx0sOUE:CQDx73DKycWrhDuBrBglct7VLfpxTE
TLSH
T1D36633112A6DC957DA498D35431BE3AA70E6FDC52E52C3033B40BB65BC96B53F8ADB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
2876	npp.8.9.3.Installer.x64.exe
2876	npp.8.9.3.Installer.x64.exe
2876	npp.8.9.3.Installer.x64.exe
2876	npp.8.9.3.Installer.x64.exe
2876	npp.8.9.3.Installer.x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npp.8.9.3.Installer.x64.exe

C:\Users\Admin\AppData\Local\Temp\npp.8.9.3.Installer.x64.exe
"C:\Users\Admin\AppData\Local\Temp\npp.8.9.3.Installer.x64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj8DA7.tmp\InstallOptions.dll
Size 15KB
SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
MD5 cfc7c53e282b0a7c527e4ed091f17fcd
SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
TLSH
T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj8DA7.tmp\LangDLL.dll
Size 5KB
SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
MD5 4b8a750993567ac9a350ba9768fabfa0
SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
TLSH
T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj8DA7.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsj8DA7.tmp\ioSpecial.ini
Size 1KB
SHA256 95448f1330228d1f8984d80b21ead42453abf98a29fae36fa3410c4c3524e9b5
MD5 ae1d2e0f8145e4527a36e63555d083b9
SHA1 7b0059a656280a97fbb2fc9ad414d4992a3d6d14
SHA512 3acf81f4fb8c9a1fc3df522027775c295d0b42775f3f565fa4634e9767d3fbf491452c7eff6bb01a3b38b6c60a69f86bb8b9ce5c7661dfabdbac3416fbd214a6
TLSH
T1EB21B0437BFC1214F2BBBB14FFB541758B3A7C569839D60D41C0094E09E9B408963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj8DA7.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads