Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/06/2026, 10:53
Behavioral task
behavioral1
Sample
setup [2-19417].exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup [2-19417].exe
Resource
win11ltsc2024-20260618-en
3 signatures
150 seconds
General
- Target setup [2-19417].exe
- Size 1002KB
- Sample260623-my1tcsb13p
- SHA256 5ece5bf9e9dcb27226caeda3a8da167bc20f43312b1d35d2618a13777abe548a
- MD5 20174de28f463b7d4a2937558131922e
- SHA1 d66c90731a332993ae1a9f74e06f9d72c3ba5ab4
- SHA512 1204687192423c268f90efbd0fb384fcd65459e6c94f9fd2741d943a61b3ab89583c80bcdd514bc20034721e0200944e43c811af50cb65798af1950e5b622cb5
- SSDEEP 24576:M7Lt9UqF4U6KOsge8K6Jtt4+ud3Mys7y58aX403GwgZOV:Ct9UW4YKeEttN5d7y58YWfi
- TLSH T1A0252303BAE5817EE42B0135E4D246B927F7DDAB3A1A8A872FC0FF175931AF50E40495
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 4860 setup [2-19417].exe 4860 setup [2-19417].exe 4860 setup [2-19417].exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup [2-19417].exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsmED89.tmp\InstallOptions.dll
- Size 14KB
- SHA256 a25228ed00282372cac3349296613884d6c7fa2f041b3ad7df8388659f9e20e5
- MD5 bec6315d69bcfd3588839959d326417f
- SHA1 96086501633dea36373557f2b533e648822f1233
- SHA512 34e59e6427ead069150609329016c06f6e2b9cbb3a146c9ce243b88fb9a8dd727cc1c791d0741ef42e68b4dc5543922b990c15122b30967cbdd5cc4fdb064600
- SSDEEP 192:46JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTZK72dwF7dBdcQOz:46JaVh4I5rpPbTZ+BdhO
- TLSH T171523951378888F3E792053EB45237079F9D5226B8929ED1CA331FC22D2B19E2FB1302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsmED89.tmp\LangDLL.dll
- Size 5KB
- SHA256 83271293ac30de94c35e835c51a377722790a798c0ca0649092a0a60a9bbc349
- MD5 2357801ccb2f2365712ef08be70443b0
- SHA1 a18377161188b4f2fa60c7f6abbfceb49186f0a7
- SHA512 8bb2232fc74afa996457710c3f6f06f8ce0da08f6aa17f21f756e871dd2a322222bcf4a6347eac1b2096d5f958bd75e4d56572fd871103c2a54e711bfe54bcd3
- SSDEEP 48:SnPQ/z+vUML8eYXICmlmGYKHz0JSpXSxwo6mpwzcR3RqG8aEJSABofgMGKO:bz+MM4eqmvz0JScx56mpwzAhWiGV
- TLSH T11EB160B2F38045B5D5A44977146BA7D33663DD302B9A021F9B67051B6800D93AC7DB83
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsmED89.tmp\StartMenu.dll
- Size 7KB
- SHA256 4aaf1bc9262288e0a380ec9396d384dc55686f932675a1de0499318499950fa5
- MD5 89ed163bc674b9542c9a45dd50848c98
- SHA1 c261c7ad98de77f95d252afe24a4ba07bea52a3b
- SHA512 bb11b4a5a792688c8021ccae77827e90a28c911bea303155e8b87dfb0dd2432014d7bd2915fc128eab7debb57397b10be1b46615d695ec73eab2195627f38c63
- SSDEEP 96:Z+zBC0x22epxPEvC4FkWE+in1/FMvsCGRfRFqCB5tXGhEl5VN:Z+tepxPE1r8/FtmCDtWg5v
- TLSH T1EAE1F87AF7C044F3D68B43702863BB17EB66DA2117257163992716CAB5C24E3DC24722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsmED89.tmp\ioSpecial.ini
- Size 718B
- SHA256 f61fd0b69ef8cc75468d2a50d56d707c3e3ff805fee6d70f537095aeb8a9ee00
- MD5 2d8e15b6d33e4a823ec6aa084c332ecf
- SHA1 0f7289564afd4d3532a05be05e9da1766ccdd486
- SHA512 f33ffd9307da0ce837898b6e49694f0fdf545e7aa0c77caf4415bd6d04560cd4d3f97c6f6b87d85ba98aae1a97061a5fa0a2b2cf1280fda79cc4788232038f37
- TLSH T1D40115D8845FD3540851209775FD77D257903C5C8B223CF26062C88B438D9C745DADD2
- MD5 SHA1 SHA512 TLSH