8db87a458551371e911bea5243840c783b5e7d41b7f867a2a6f74971881fb1e4

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
npp.8.9.3.Installer.x64.exe
Size 6.6MB
Sample260424-kyaaases7p
SHA256 8db87a458551371e911bea5243840c783b5e7d41b7f867a2a6f74971881fb1e4
MD5 3419ce845525534cda48cf6959bc41c5
SHA1 32d5f6f3ae0354dbd44afbaf99bfd1d3977668d2
SHA512 f0016b08ff63855e12ff3418909086041e456271fa3e0883c52088f48aa9be13bd0d028c35abc994ce8816009594ca875bfd349757b83f160969cb7c41070440
SSDEEP 98304:CQvozTSOU7wEDKJ1acuNX/PjhJ4LWuBr88glx2tDvDBPWMfUqx0sOUE:CQDx73DKycWrhDuBrBglct7VLfpxTE
TLSH
T1D36633112A6DC957DA498D35431BE3AA70E6FDC52E52C3033B40BB65BC96B53F8ADB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
3572	npp.8.9.3.Installer.x64.exe
3572	npp.8.9.3.Installer.x64.exe
3572	npp.8.9.3.Installer.x64.exe
3572	npp.8.9.3.Installer.x64.exe
3572	npp.8.9.3.Installer.x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npp.8.9.3.Installer.x64.exe

C:\Users\Admin\AppData\Local\Temp\npp.8.9.3.Installer.x64.exe
"C:\Users\Admin\AppData\Local\Temp\npp.8.9.3.Installer.x64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsmA8C.tmp\InstallOptions.dll
Size 15KB
SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
MD5 cfc7c53e282b0a7c527e4ed091f17fcd
SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
TLSH
T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsmA8C.tmp\LangDLL.dll
Size 5KB
SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
MD5 4b8a750993567ac9a350ba9768fabfa0
SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
TLSH
T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsmA8C.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsmA8C.tmp\ioSpecial.ini
Size 1KB
SHA256 de9b4bc97b32f411700242e238fe22d16968061c04d588729401a6c22fb3040e
MD5 64994c48b91efd21096dab300e9969c9
SHA1 d2a01093d6c790ab2e71bb1ac3a7eb3b80d664e9
SHA512 18e0bc2004331cdc15ecb9c439e3c98e0c5d81da25b34350a0f743ac9800087953772b3a55a9029441b3623f2658d4db89dcf365e4db125e2ccff1991d9d25fc
TLSH
T1D221B0437BFC1218F2BBBB14FEB540748B3A7C569839D60D41C0094E09E9B408963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsmA8C.tmp\ioSpecial.ini
Size 1KB
SHA256 c4ba6887df39a751071934fbcdd3b3a1fdf3a4233fb3b6a6184fba4bba6f3d3a
MD5 faa58d4f36e79ce8ed49112f1ad6186c
SHA1 810d869405cc8d601113cdbd8360215f441f71b8
SHA512 4931028773b4b1a7e29e980c0a775b1bfffae1ebfe1c42fc521dcfb880c1ba282f85b8d7f703049622e42a5754cecda1eb6636e233ad6ca876e10d57b4e904d3
TLSH
T1B131E2033AFD1218F2BBB714FFB441748B3A78569839D60E41C0098E09E6F408963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsmA8C.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3572-89-0x00000000009E0000-0x0000000000C6B000-memory.dmp

Download

memory/3572-93-0x00000000009E0000-0x0000000000C6B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads