c127da8d06ff467e2dfb7a6fa73a3100829ec38061e8280dbb4e35aa1d73cc4e

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SaveSamitheTurtle.exe
Size 3.7MB
Sample260508-2a8avse151
SHA256 c127da8d06ff467e2dfb7a6fa73a3100829ec38061e8280dbb4e35aa1d73cc4e
MD5 7d1c6bcabf22729473a19b482a064488
SHA1 e9f67af7cd5593bdefd8ce9ddc8111fea160b56d
SHA512 1b25cce40127001117098962063d1b288995271327c02585f0be856493333e4924994747ae4f9d6119074eb24e6c909c5d857139353be7eef03e15cfd13f2b2e
SSDEEP 49152:48ntDZAcCVT1Zgg3Sk5Tx6CtcX4EwgGWYAiRzg1vR7ep1VR+kA231M6q2WateUKC:rZAcCKaZuX4EwNBd2ypR+Ho+2WbHTC
TLSH
T18906EF53AAE65065C8B10074D4F98A2229AD7E3CDB26C7D391C01FBB7A331C39775AE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2188	SaveSamitheTurtle.exe
2188	SaveSamitheTurtle.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SaveSamitheTurtle.exe

C:\Users\Admin\AppData\Local\Temp\SaveSamitheTurtle.exe
"C:\Users\Admin\AppData\Local\Temp\SaveSamitheTurtle.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mmf2d3d9.dll

Path C:\Users\Admin\AppData\Local\Temp\ee67d99d-0785-45a2-8089-04dceeafb554.FusionApp\mmf2d3d9.dll
Size 1.1MB
SHA256 3cde7a9181ab63a42cd3535d279d0ab1397b7b78fa3ddddef832757ab2024101
MD5 72bb9180f8905c0da95566b778cdac5e
SHA1 e96145e8120514092b35f67f1f120b958997f921
SHA512 c2c8d8c74c53a78545e69f27a7fe1a6d1291888158962e93e16e6ec9950f86e74c68bd2eb50d04db0bff58e8dc93455aa384245991c5afe34abee36fef53710f
SSDEEP 24576:EE6cfv6jilsTCw8RCmttZtcJPFGySBDmXA4HwLSJcl:CyA8omXGSFmdkl
TLSH
T14135BE51F292C036C0AB23710657A3B932BDAF251D7585CB1A88BDBA3F345E147293DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmfs2.dll

Path C:\Users\Admin\AppData\Local\Temp\ee67d99d-0785-45a2-8089-04dceeafb554.FusionApp\mmfs2.dll
Size 501KB
SHA256 2d2a6a74364bebfa0fc5036ab472aa2f4cc6cfd1ec2cb04b6b7b6c9c02a06d83
MD5 834167ab085783b2d1c738296dd477ea
SHA1 52a013da3d860fa470dc9e2df3e8d2e1799a3fb1
SHA512 8a3782e8a30835e3b1f12028ae728c4e50ef15d60f33dd9cd20597bc74ee5fadc19c9d67e572b43f61537c00ce4d9cb983758d6fdf50cb84ef86f95f41cd989d
SSDEEP 12288:Cl2w5SNFe2TMNMfeZJyxqNEQ8W7zf+IL2SUoOHxwVoipcVDNLTrgqiJs:PdNFe2TMNMG4qNEQ8W7zGWYd1DLTE9O
TLSH
T1F5B4AE10B982C231E4EA11B28AFDBFAE152C677147B859D75B485DBD1D300E32F3266B
MD5 SHA1 SHA512 SSDEEP TLSH