caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/06/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe
Size 678KB
Sample260630-dcs2ysc19y
SHA256 caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8
MD5 47e5526a49468b5f09a308bdbcc14429
SHA1 1178819f033897aa05661ceadf24149e0f56ec19
SHA512 611a9a0533404bf26da8e0f317648002dd8403da4aec23c64a46d41add89522cb4b38fef618a2bc2a595824e373dc93fbff7650ebd97349b3759b95d823a5449
SSDEEP 12288:nNbPw+zB8c70DtiqjkyZMGFPxiBrzz64dCA1EVB22e/LVo:nN8+zB8c4D0OMmcBHu4YA1EVBC/5o
TLSH
T1C8E4F0197214A077C59406723AD6823FEA647ECCA6C6030723B8B73B79F154DFA057BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
624	caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe
624	caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
17	drive.google.com
18	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
624	caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe
5036	caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\allaeanthus.lnk	caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe
File opened for modification	C:\Program Files (x86)\Common Files\allaeanthus.lnk	caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe
File opened for modification	C:\Program Files (x86)\Common Files\reostats\septocylindrium.ini	caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\varelagres.jpg	caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe
File opened for modification	C:\Windows\Fonts\navnefringer.ini	caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
624	caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 5036	624	caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe	94
PID 624 wrote to memory of 5036	624	caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe	94

C:\Users\Admin\AppData\Local\Temp\caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe
"C:\Users\Admin\AppData\Local\Temp\caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:624
- C:\Users\Admin\AppData\Local\Temp\caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe
  "C:\Users\Admin\AppData\Local\Temp\caf44a2d4d469a2ec1b8acf1df9e5dabb3561bc7d580ea0e83a3523bde454bf8.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsb4844.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsb4844.tmp
Size 1B
SHA256 8254c329a92850f6d539dd376f4816ee2764517da5e0235514af433164480d7a
MD5 8ce4b16b22b58894aa86c421e8759df3
SHA1 13fbd79c3d390e5d6585a21e11ff5ec1970cff0c
SHA512 2af8a9104b3f64ed640d8c7e298d2d480f03a3610cbc2b33474321ec59024a48592ea8545e41e09d5d1108759df48ede0054f225df39d4f0f312450e0aa9dd25
MD5 SHA1 SHA512

Submit Download

nsb4844.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsb4844.tmp
Size 3B
SHA256 01a219245e1501fee01ce0baea8f6065ce5162cea12fa570689a07c9717be81d
MD5 4e27f2226785e9abbe046fc592668860
SHA1 28b18a7f383131df509f7191f946a32c5a2e410c
SHA512 2a23585835bdb5db8175cab265566042282841efdcee8aaba8b9b5d466b0f165c0c5973033ce94bb9a8f07a956689247981ea07ac5a51408263e1653d9710adb
MD5 SHA1 SHA512

Submit Download

nsb4844.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsb4844.tmp
Size 6B
SHA256 6923dd1bc0460082c5d55a831908c24a282860b7f1cd6c2b79cf1bc8857c639c
MD5 50484c19f1afdaf3841a0d821ed393d2
SHA1 c65a0fb7e74ffd2c9fc3a0f9aacb0f6a24b0a68b
SHA512 d51a20d67571fe70bcd6c36e1382a3c342f42671c710090b75fcfc2405ce24488e03a7131eefe4751d0bd3aeaad816605ad10c8e3258d72fcf379e32416cbf3b
MD5 SHA1 SHA512

Submit Download

nsb4844.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsb4844.tmp
Size 9B
SHA256 ae789a65914ed002efb82dad89e5a4d4b9ec8e7faae30d0ed6e3c0d20f7d3858
MD5 2b3884fe02299c565e1c37ee7ef99293
SHA1 d8e2ef2a52083f6df210109fea53860ea227af9c
SHA512 aeb9374a52d0ad99336bfd4ec7bb7c5437b827845b8784d9c21f7d96a931693604689f6adc3ca25fad132a0ad6123013211ff550f427fa86e4f26c122ac6a0fe
MD5 SHA1 SHA512

Submit Download

nsb4844.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsb4844.tmp
Size 10B
SHA256 a7de06c22e4e67908840ec3f00ab8fe9e04ae94fb16a74136002afbaf607ff92
MD5 9a53fc1d7126c5e7c81bb5c15b15537b
SHA1 e2d13e0fa37de4c98f30c728210d6afafbb2b000
SHA512 b0bffbb8072dbdcfc68f0e632f727c08fe3ef936b2ef332c08486553ff2cef7b0bcdb400e421a117e977bb0fac17ce4706a8097e32d558a918433646b6d5f1a1
MD5 SHA1 SHA512

Submit Download

nsb4844.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsb4844.tmp
Size 28B
SHA256 32d0b56f8956606f9f222c2b59cfa3d2bd74d3c03826d0d24e505f631ed7655b
MD5 6a4068fda4a2c206a11f230fec5cdaf4
SHA1 979e82015b704f0aaf76c53eb46374f3147f0f14
SHA512 828f7bff7c2e8d4987d393fc1d6ec3fb09b074c59d3ad19351301ca884d90b26036114cee560aa67af250fecb58debffdca9ab34b663f9a0c9ef57a71135b080
MD5 SHA1 SHA512

Submit Download

nsb4844.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsb4844.tmp
Size 56B
SHA256 6d09b160a01f42abd41828782ba257b44c41c7553baa7017f7236336b85deffb
MD5 6bdaf965aaeb08a10acbfa2eeb999079
SHA1 c3e682b05cc4b9eb6885361fc830dc0778390e4e
SHA512 d3663005b437f5b597eec867add0a66b758d957a764aadc335d3eccf1e5285d75376857842a88a44396adebdae0d9e0256c151acbdfb0a9f101634f4ce6d5c89
TLSH
T1A090022455567960B29AE8D54C918955910895145817444106A84490714188F8406548
MD5 SHA1 SHA512 TLSH

Submit Download

nsg4729.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg4729.tmp
Size 8B
SHA256 1c329924865741e0222d3ead23072cfbed14f96e2b0432573068eb0640513101
MD5 c3cb69218b85c3260387fb582cb518dd
SHA1 961c892ded09a4cbb5392097bb845ccba65902ad
SHA512 2402fffeb89c531db742bf6f5466eee8fe13edf97b8ecfc2cace3522806b322924d1ca81dda25e59b4047b8f40ad11ae9216e0a0d5c7fc6beef4368eb9551422
MD5 SHA1 SHA512

Submit Download

nsg4729.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsg4729.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl460F.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsl47E5.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsl47E5.tmp
Size 53B
SHA256 d5b8ef6fd4f9ba99bcddf112f601b1253e0757ec676dda49d80562e2b408c9ef
MD5 2d8f2eacb5602ad5ec237a74227e457d
SHA1 e9b88aebe17b79032e0691dc67d8ba2ab1bb84e5
SHA512 e900590e2ec8bf56bdee62f34879c5610234b7cacf111c41de4895b97e06fb771f23646bb996ef56fd5f8da01596090818116bd5bae33441a7f0b201fb621e3f
TLSH
T14390022941545990379784255E71A1345309D8540C3604220BAD4901740340F4113109
MD5 SHA1 SHA512 TLSH

Submit Download

nsl47E5.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsl47E5.tmp
Size 54B
SHA256 766c5b4c124c9023791a318c12ab51a6c4816c202f3191639cda0d54bfb32fdc
MD5 bc69d6b753fdf8a235656ce7c721ea34
SHA1 08debfa18d0978adff8e193222bd387c7ba53fb5
SHA512 4bb85f4a2635f6754e00c5e4d13e53725f594a6e47104fafb67fe7fc3a0eb8085ca67439b899de55fde209f65ebdf5d9323dd7217c69e2172f01a87ed9d8fdbd
TLSH
T10790022941545990379784255E71A1345309D8540C3604221BAD4941740340F4213109
MD5 SHA1 SHA512 TLSH

Submit Download

nsl47E5.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsl47E5.tmp
Size 59B
SHA256 85beef3c05cd1fb09ad035a6d939bba5058deab3483720c4bed92b00f0337cf2
MD5 f70f09c5c010f14237ec85caa6d04e8b
SHA1 25abe57f8ae545e15459635e1c85b4dc9c08f60b
SHA512 97fe1358feda2e054c632d1b271e5d4ecf7211b41d1eec6ba326b323debebbc4ae4bf59d340bc53434785c9cd270cf9a8c95870362868572627e4744edd3d4a0
TLSH
T1A2A00229819559D0379784265E71A1345319E8544C7704231BAD5941B41354F421314D
MD5 SHA1 SHA512 TLSH

Submit Download

nsv45FE.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsv45FE.tmp
Size 56B
SHA256 8e2bcf9feac393966111f1f2da0442a81206f175f5c983d54c155dc9dca8b35c
MD5 2cb7f4baa71de08f1ae6dba013610a25
SHA1 8edf21d90c6e80a0a011f8f1bc5e7e06df56a15c
SHA512 b4de96747cd2c4ec98837f4634afc86b80c0c186d58023b37e2f468d97ca8c3cf2c19a4ccb4e4456e73b2629f65376d9934119542ca4e990a0c277e873cb77cc
TLSH
T16D90025624814654F582C4711B657008E59D302600C544031A4D44485D05057CA0A5D4
MD5 SHA1 SHA512 TLSH

Submit Download

nsv45FE.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsv45FE.tmp
Size 64B
SHA256 791004efaa6a41452708fe5db95097b4681e4f4d386e33b8044088b8f736d743
MD5 814da453daa6269ca4ed4cd15266b28c
SHA1 82981f8c0d5d3ffccbf06fff867f8c3b1aaa454b
SHA512 3336dbdf67c28567e9cd6a495e2e7d7e7fca21fccdff35b7c84588237829c32f69be5f733cbc3e3bf1614868a3e9e6000c5ff3116b4cc035723c37ca743cb948
TLSH
T12DA0025635814664FEC2C4711F65700CE59D303600C544031A4D48489D05067CA0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsv45FE.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsv45FE.tmp
Size 5B
SHA256 ff91566d755f5d038ae698a2cc0a7d4d14e5273afafc37b6f03afda163768fa0
MD5 e2fecc970546c3418917879fe354826c
SHA1 63f1c1dd01b87704a6b6c99fd9f141e0a3064f16
SHA512 3c4a68cbaee94f986515f43305a0e7620c14c30213d4a17db4a3e8a1b996764eb688bf733f472fc52073c2c80bb5229bb29411d7601aefe1c4370e230c341a0a
MD5 SHA1 SHA512

Submit Download

nsv45FE.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsv45FE.tmp
Size 12B
SHA256 73842f82df7cfef99c471c4301ef8130ddcd65d831b069b880bd71695d2bf607
MD5 e456acec0ef7fda3aef06b03bb007e2f
SHA1 a7168146dd22139e81563b24beb736179d1c8370
SHA512 c641ae2e8961562f5fd0f2d258742b024c6564b3f3b6a1d3d642d72bf47a1d6c208055e31dc467a3ea41b7bac658bcbab6e1746daf08fe2484f0c860fb88d475
MD5 SHA1 SHA512

Submit Download

nsv45FE.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsv45FE.tmp
Size 41B
SHA256 8b0454c42dded71d9ee62354260d89e0565bb803a300bb2c49c9dd50fd2d1c4b
MD5 9b63af13344f6ef82f01f463737f3a43
SHA1 8d8b471641cae2462b39fa096c26475167bbf274
SHA512 708585072fc9f56b68a2737726b580347861fc188d60b19e59d9b6b4a9fcd25e39a972254146f97d4aee32fc9502546c5da2803b027222f70de6d223e93db674
MD5 SHA1 SHA512

Submit Download

nsv45FE.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsv45FE.tmp
Size 45B
SHA256 8d563467c54bb057b01f2366722a14e9416510bf4955afa746cbeb2f221312fc
MD5 5bc80a3e025e6d7c0ff9536d7af1c8b1
SHA1 c7dca5ef716161e30829bcfe28b59ec430fdbec0
SHA512 cca0649c6cc7a92de2c46bf64084bce5e0ce44ef5acbdcb7527231d5372d74b0a1b3d0856ecfa0d32a5a0fbf5219df8117b14bec29d513fb55da0d1f25a6ad8b
MD5 SHA1 SHA512

Submit Download

memory/624-563-0x00000000749E5000-0x00000000749E6000-memory.dmp

Download

memory/5036-564-0x0000000077D88000-0x0000000077D89000-memory.dmp

Download

memory/5036-565-0x0000000077E29000-0x0000000077E2A000-memory.dmp

Download

memory/5036-575-0x00000000004A0000-0x00000000016F4000-memory.dmp

Download

memory/5036-576-0x0000000077E29000-0x0000000077E2A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads