46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
Size 235KB
Sample260508-ps7e3ag191
SHA256 46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042
MD5 8d17b06464f37338ce8b369ceffe5b65
SHA1 d2680a0f70a175ac37afe9d1d4c4824de0d3dad3
SHA512 e365ef022f6003b3e02710523ac40a0cc0b67e79aa613ec55fb8edc28185b66762d9008eb400078a43b519265654aa9574a8e632cf949d59cbab37b1a1274161
SSDEEP 6144:sqjIcRE6w/RSFHMR9aCXGa/NQNbhCkrvCWLN:pVRvw5N9/i/COvj
TLSH
T1DF341266B2E8CA67CB6F52704D3BA591BFE5E3110158174B4B5CBF98BD14E52022F883
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4144	_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
4144	_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4144	_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
2164	_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\rance\karakteriseringens.zip	_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4144	_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 5700	4144	_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe	79
PID 4144 wrote to memory of 2164	4144	_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe	80
PID 4144 wrote to memory of 2164	4144	_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe	80
PID 2164 wrote to memory of 5876	2164	_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe	81

C:\Users\Admin\AppData\Local\Temp\_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
"C:\Users\Admin\AppData\Local\Temp\_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Users\Admin\AppData\Local\Temp\_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
  "C:\Users\Admin\AppData\Local\Temp\_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe"
  2⤵
  PID:5700
- C:\Users\Admin\AppData\Local\Temp\_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
  "C:\Users\Admin\AppData\Local\Temp\_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Users\Admin\AppData\Local\Temp\_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
    "C:\Users\Admin\AppData\Local\Temp\_46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe"
    3⤵
    PID:5876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsa2007.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsa2007.tmp
Size 37B
SHA256 df9ef051e1940f576446c4ef6d4ee0f201488c4c0485c26ef2bd3923b3e6a761
MD5 c641bfa28a71f86301ed9e81931da24c
SHA1 59770ef0e9c2658e6aacd708615767660a2dec66
SHA512 e2e24f388600ca77ea717c8ebf382ff961cf20ae054d807526dddf28e5a328cbacfb57a6d00ad43afca0a4bc00ebb3f42a169de1fa5787265f468fe9056d093e
MD5 SHA1 SHA512

Submit Download

nsa2007.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsa2007.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsa2007.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsa2007.tmp
Size 42B
SHA256 d0e907cfed7dd830efd34ab698cfbc7726f29b52b71479f6ee9cc34087925d26
MD5 b6a6fc39000a885d47bb4a68599189d2
SHA1 2e6af0f8af28d0ccf111437ebdef42fc9b87d976
SHA512 79f428030deceb2504105b031f605836640f70e070c23dfc3d8f815c3b08b7377cb53455e8a8333dd7b2fca5507da24682b809eb586d8ce3a223e532a93d9263
MD5 SHA1 SHA512

Submit Download

nsa2007.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsa2007.tmp
Size 62B
SHA256 fcc0de8ebc57a00f3f48bc8ba2e93cedc7efe9ecc9600ad63cdd1ba1d6c4fdea
MD5 903e0572b61353c5e9e2f94582bd26d9
SHA1 bf6d18b2607a519c4486e845921b7070e53cb8eb
SHA512 3857e85783aa8af1cd075e91729bfd471c3df9d93d944501bf8bd663df9ad1348ee9d81403505851d468beaea9a3ac0ad6799eb4b2e328176c27d32cdf206b94
TLSH
T159A0025635814664FE82C4711B65700CE59D302600C544031A4D44485D05067CA0B5D4
MD5 SHA1 SHA512 TLSH

Submit Download

nsa2007.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsa2007.tmp
Size 69B
SHA256 ab4b36271e68b6e5b546158733c5450e775242021442a40bec4e42838eecca53
MD5 3f9d86b820955195e9467112480c175c
SHA1 c9b53af6ff79125000b5aee2afb33ce6575d4d31
SHA512 ed78bd4b7b9b953bf73b1156872864b68ba1b46b3c2e5d21c56766217ec8b70e6421796a9d31716a94d62d81cf7a2c9f83735ea7c229881d4845c70364b77a17
TLSH
T1A2A00256358156A4FEC2C4711F65700CE59D303700C544032A4D48889D45067CA0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsl2049.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsl2049.tmp
Size 60B
SHA256 4d93bc9922223510f53dfea3572e7d77a82a85d0782948eb0b962edfb8a867b8
MD5 3f54b69fecf122b3c27d0d626619d50f
SHA1 ab305e3eb089cb979e9f486c3aea7466899867bc
SHA512 2bcd3e42448606e38f52ac3f80d7129bd8ebc78ba681303b6f0de70624dd5488b96c8721b8106a548e02ce24526351352fa21fd21ff593938626ff8c1f503ea8
TLSH
T193A0021941914AD03687842A5F31A128531EB8455C7718131FEC5941F82718E420715D
MD5 SHA1 SHA512 TLSH

Submit Download

nsq2069.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsq2069.tmp
Size 56B
SHA256 c0df30fbab2fa581e76023ec90a1e9d5d0d40adcbfdafa2aa6acd3d0d3b6752b
MD5 178a9b4be2b4ef57d9130f23412bd5b6
SHA1 55eddf2bee10dbbe04ef463d49f4a9515c885386
SHA512 3e0f795c113a5005acc632cc3564a651e71a59b7f10c92652a35ac83ec6623b90721ee06813a49f0ef38dcf9b9d5a6b19813829662c749c536b94ff5931b21b2
TLSH
T16590022415957A64F186E8E94D114A4592096505581B14020AE54090B5554C7881A588
MD5 SHA1 SHA512 TLSH

Submit Download

nsq2154.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsq2154.tmp
Size 20B
SHA256 8678054a5a992d44bb69e4ab770e4d17cd1530511f044754ba3a15e59121cba4
MD5 3bb6070b3e4cbc844c6cee699666f746
SHA1 eaeb87f3175746d3c8a0896e35f5f2d3ad4f2d7b
SHA512 cf53f306a00ef5ed498c1dcaa426b013a64520938f492d77cd0f1cc15dffe37d465f30b9e15d451e1f85ed8e67f2ebed0930302ddb94b2f7172dd9e4fd6c52f7
MD5 SHA1 SHA512

Submit Download

nsq2154.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsq2154.tmp
Size 29B
SHA256 1cd17ebc8f026d74e357291a799786fd75557cfb6752ab682fb941ae1e91dc2a
MD5 8c3ede6c7733ece88212b60aeab2f37e
SHA1 3f0fd925744587ec6cf82b8763d3bc585323aeca
SHA512 8c6c8452744afcd83c14c905a2f100a48cea59c96712747a0a72cfada0d1a1481031bf6cca75113a00deab10ea0222f1965d2d2965eab2ebbf60fac34850c915
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv2037.tmp\System.dll
Size 11KB
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
TLSH
T116326D5503504AF3E996863C00263B7FAF796A2095F14D53CFA394C0FE2E5C9AD38352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsv2038.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsv2038.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2164-562-0x0000000077528000-0x0000000077529000-memory.dmp

Download

memory/2164-563-0x00000000775BB000-0x00000000775BC000-memory.dmp

Download

memory/2164-564-0x000000007753B000-0x000000007753C000-memory.dmp

Download

memory/2164-565-0x0000000000450000-0x0000000001767000-memory.dmp

Download

memory/2164-566-0x00000000775BB000-0x00000000775BC000-memory.dmp

Download

memory/4144-561-0x0000000074234000-0x0000000074235000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads