79bfaec72fcb852f1c4ced442b91d7b382cd4d1105ee3a89649064cce99d1eea

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/05/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Uninstall.exe
Size 101KB
Sample260530-rms2laex51
SHA256 79bfaec72fcb852f1c4ced442b91d7b382cd4d1105ee3a89649064cce99d1eea
MD5 ce3f0f544e12aa729f3a848bf6085213
SHA1 6c2dc1cdb04c1816573f0102aaca2105aae42c34
SHA512 752b4d27a18b06f51c1ff027ea99ce5808f10499e7add4f7b21a977143864ca4e9ebee790eeb10ba69dbc9176ce78d91f0cc9c0ea570562a3ace3eba667c8c98
SSDEEP 1536:jQdZEszWriITJGrvopX1VF7CXjl7yuqkSZZZ3gURD8ib8OWg/7gnFmSMLi:jHszWOITsEL50jl7yAUNRD5bvWhnFmM
TLSH
T177A35B026BA0C1B6F9E607302CB797225F76BC2559B0970F73903B4EFC726419D2976A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1160	Au_.exe

Executes dropped EXE 1 IoCs

pid	Process
1160	Au_.exe

Loads dropped DLL 1 IoCs

pid	Process
1160	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uninstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1160	Au_.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1160	4748	Uninstall.exe	89

C:\Users\Admin\AppData\Local\Temp\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc3DFF.tmp\System.dll
Size 11KB
SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
MD5 959ea64598b9a3e494c00e8fa793be7e
SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
TLSH
T1B3322A2657B0D2F2E6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Au_.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Size 101KB
SHA256 79bfaec72fcb852f1c4ced442b91d7b382cd4d1105ee3a89649064cce99d1eea
MD5 ce3f0f544e12aa729f3a848bf6085213
SHA1 6c2dc1cdb04c1816573f0102aaca2105aae42c34
SHA512 752b4d27a18b06f51c1ff027ea99ce5808f10499e7add4f7b21a977143864ca4e9ebee790eeb10ba69dbc9176ce78d91f0cc9c0ea570562a3ace3eba667c8c98
SSDEEP 1536:jQdZEszWriITJGrvopX1VF7CXjl7yuqkSZZZ3gURD8ib8OWg/7gnFmSMLi:jHszWOITsEL50jl7yAUNRD5bvWhnFmM
TLSH
T177A35B026BA0C1B6F9E607302CB797225F76BC2559B0970F73903B4EFC726419D2976A
MD5 SHA1 SHA512 SSDEEP TLSH