66f9c03e6cede3672733babbe9a14ec96ade883116c95f9a16614cbe06d27ee9

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Livecare_assistance.exe
Size 1.9MB
Sample260602-anvs5sa18n
SHA256 66f9c03e6cede3672733babbe9a14ec96ade883116c95f9a16614cbe06d27ee9
MD5 808c7e87c2a371bb8c70c9ce00b9bfe5
SHA1 2bcfc9cc19fb0d76cdab3468bc76baf81f35d90e
SHA512 4fde06914499391af5e07ed5023d12119a8abbab59d71a920796d95d7fee80d60d31aa765cf9797c7e56caa12619e39154c43faa4d62c0fa64576de93ac55cd1
SSDEEP 49152:B/OJzBTOPS1h9pPlHngW38tYPDL1dJc67Tl:B0zBCqvdz3h/rJc67Tl
TLSH
T12095339A63B4FE57EAAA197024B8D335B2B5DF4C7411CA462738BA3FBA33641371D011
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
624	Livecare_assistance.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Livecare_assistance.exe

C:\Users\Admin\AppData\Local\Temp\Livecare_assistance.exe
"C:\Users\Admin\AppData\Local\Temp\Livecare_assistance.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdD9B3.tmp\System.dll
Size 11KB
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
TLSH
T107324A5503604AF3E986843C086A3BBF6F796B2196F04E53DFA384C0EE6D5C96D78352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download