2c5f01d6c83016c03d2786f8cf095a3c713103e1670898df9a8eb7ff72358dee

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DEFENSEIA-CLIENT-3.2.3-45e8be270fd4a78dfba985ab4cafbc4a.20250606.exe
Size 219.0MB
Sample260702-rte4bac16p
SHA256 2c5f01d6c83016c03d2786f8cf095a3c713103e1670898df9a8eb7ff72358dee
MD5 45e8be270fd4a78dfba985ab4cafbc4a
SHA1 9fcb0b6cc02165baf47b09782d62389c7724887b
SHA512 facadf963d8e3382fd7b195e2cb78e5644ac6ea2c13a928c38466f8ddefe863c69a304278d694f01e46fc879cd9fbcfc07657f89eec8c7e39db343ee58fea1c7
SSDEEP 6291456:u2SYvUXz2CFB5L0VyKOwDDh0vAy8zpP1mpW651c:u6sz2CFPLxnwDmAyUGWQ1c
TLSH
T1FFB833CA280F1283C3B1DD7826657225E1875F77A9C4FC48A3A176DE1CB29225C46BFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
3444	DEFENSEIA-CLIENT-3.2.3-45e8be270fd4a78dfba985ab4cafbc4a.20250606.exe
3444	DEFENSEIA-CLIENT-3.2.3-45e8be270fd4a78dfba985ab4cafbc4a.20250606.exe
3444	DEFENSEIA-CLIENT-3.2.3-45e8be270fd4a78dfba985ab4cafbc4a.20250606.exe
3444	DEFENSEIA-CLIENT-3.2.3-45e8be270fd4a78dfba985ab4cafbc4a.20250606.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEFENSEIA-CLIENT-3.2.3-45e8be270fd4a78dfba985ab4cafbc4a.20250606.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3444	DEFENSEIA-CLIENT-3.2.3-45e8be270fd4a78dfba985ab4cafbc4a.20250606.exe
3444	DEFENSEIA-CLIENT-3.2.3-45e8be270fd4a78dfba985ab4cafbc4a.20250606.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	DEFENSEIA-CLIENT-3.2.3-45e8be270fd4a78dfba985ab4cafbc4a.20250606.exe
Token: SeDebugPrivilege	3444	DEFENSEIA-CLIENT-3.2.3-45e8be270fd4a78dfba985ab4cafbc4a.20250606.exe

C:\Users\Admin\AppData\Local\Temp\DEFENSEIA-CLIENT-3.2.3-45e8be270fd4a78dfba985ab4cafbc4a.20250606.exe
"C:\Users\Admin\AppData\Local\Temp\DEFENSEIA-CLIENT-3.2.3-45e8be270fd4a78dfba985ab4cafbc4a.20250606.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq6B63.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

killer.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq6B63.tmp\killer.dll
Size 6KB
SHA256 967d66f23cf3d9d3e5a4d6a9c6e366e792a98cc8a293196095b10cd82da9a695
MD5 16205cd992d3b3827573f93ab8923e4e
SHA1 4eece7a206ee619264d686ca1b3021b9f482866b
SHA512 257b2047b8e9303457bb050a760b8d2577da55642e4fb02933e6188d0591ff8adfe0c8df2a441577466f23a8e3bff2e94e9cfcfc381c4d255935123996c06d6d
SSDEEP 48:CRNdQ/SbTfx6gA6IMzLvM0Aoy3TYzyixX9o1TNRgPEgt/b82ebRuqSd7:mNGajxG+PWTwlSbpx
TLSH
T1F4C1E8F397D540B1E299033E29CB98266A70975803B510DFA9D709265F44DEBEC36B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq6B63.tmp\ui.dll
Size 172KB
SHA256 168deb5f2b887ec09b0612600a49b2b70d7605365501b3471291af67f6fa1e3d
MD5 74f560d28c33a66f4a67031aec7418ef
SHA1 aeef3daf8f7fff335be0b1c4b17ccb28b3ccc9e0
SHA512 382d19e747ebe3d8e158b8d2f247d7595b2b188e656494122a6e15aa0056c465879167096584bbac8215fe096b758f29577ccca86a7b518420ab8d2b66ab4494
SSDEEP 3072:LIso+mtONBWnFAB4BBESxSjWbtU0nwRWYtBaQu6C3RHxP38qJT4cOC:LICmt6BWnFAB4BBESxMSUvRWYBad3l6G
TLSH
T1DE048D107680C13FD59F197988FBAFAA276C6A7113A490C7B7640E69CF306D25F7A306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

English.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq6B63.tmp\ui_res\Language\English.ini
Size 2KB
SHA256 5b892162f25dd14a479777675254f3aa93de6a9741d858a50ba315adcd809635
MD5 0655c9b9a604ae09ba7a86069ac579bf
SHA1 4961c343be95df4dbc60c50e23e19c6f7ccecd44
SHA512 f29eef7e6ed8b9cb7ae3c81452e68332529a45da16f69fdcbf7634eb6e241fa75b8f0adbf02c9c70a9477b597a80aade6ac445d2be393aa5f30012465f9285ff
TLSH
T1B45130459A073732FF91135E2E23BF13BB860541681D00879AEF9AC9A2E3C06597F4F1
MD5 SHA1 SHA512 TLSH

Submit Download

bg1.png

Path C:\Users\Admin\AppData\Local\Temp\nsq6B63.tmp\ui_res\bg1.png
Size 106KB
SHA256 aecb2d5e9cf90c95016274d5eee3de64064a7d461ecbd428b7b29cb90a2c59a8
MD5 cd8ae4fa923ebb0c52fc98fdf36a8832
SHA1 f099577557ed1ef33ca99366eab8ba59de21a724
SHA512 895ad967d0ef3fa373f99e0bdc9a9741f4adf72c564b72815782ec1bc1e3bd80761572775f62d9b6697995dbc99536b2a14987ad58669ba79e1ccc80cdeafaa7
SSDEEP 1536:Isn52EihTHNUZ7LF02kF8bxZhzo8v9zP1WUWeNHlMiD6JTIzz/Q7Tx1zbdwl:x57iJWh5fkuzhDr1cWHFq7XzbdM
TLSH
T1C0B31218628E844F7CAA28E96DFC61CB5D41D7BB3286943CE4264C2B70BC9FDB453D61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb_1_n.png

Path C:\Users\Admin\AppData\Local\Temp\nsq6B63.tmp\ui_res\cb_1_n.png
Size 190B
SHA256 842d216e4d75ddae0538a393a0fd31c219cc84cd57eaa243ac5612a8721f0194
MD5 68bb454ba77153c92c9fec16a06c86e4
SHA1 b7f927f9af1e9ebd0f3e1cd4d7e1b94346cfd1e8
SHA512 b3c2aacae67563d179d538719a876efa86f92e12af52388215a84c196d265d5d72e0a44f93c3c03cb4c1866724029b7160330f5347cdc296ac27666a31c50f39
TLSH
T169C022E237A22C72E25800350A23C031FCAA29F82AC17B2C0E0670180A08A45A9947AA
MD5 SHA1 SHA512 TLSH

Submit Download

close_n.png

Path C:\Users\Admin\AppData\Local\Temp\nsq6B63.tmp\ui_res\close_n.png
Size 291B
SHA256 5bd6729be0f5573281fdeaedcd14c7ef94e376751b740eb3639a41a37f1969ba
MD5 8eccd78ea527db1d4e04025c8ddfe4f8
SHA1 f6e7a590a915fb4035a7d89868d0db11abdd2622
SHA512 da1b93e6cdabd253ca97a6fb0e9cc9fb42d71b190d8f3684b123a2a571ffe2a21d0440ae2708c8c29e2f8946c9b3d88d478664ac31c72a8d3ea307c6a4e9c405
TLSH
T11CD0EBC0B37D6CBC6B870DB206314108D0111961B917360A846E959F826C600B6AC38E
MD5 SHA1 SHA512 TLSH

Submit Download

mini_n.png

Path C:\Users\Admin\AppData\Local\Temp\nsq6B63.tmp\ui_res\mini_n.png
Size 147B
SHA256 34fa3cb2cd5d0a9f73f241aa648fa052027a12541f1059905f8b2cc19829bf53
MD5 2d656bb04905327f5a912fd8768be5e4
SHA1 6c76e634ffbd54198a392dd5b4b30713c657ec1f
SHA512 7d074631c091844b504d89285a2f6196139d130aa0bf61050aeb856012c52acc0455349657c16a56cddd7d615f65459dd63fb0fc096a3f2b4dd1f0cfb55de354
TLSH
T1ECC02BE23A617C70E74D56B74431B404983350C900D0D60D8806B07E14A418011F85A7
MD5 SHA1 SHA512 TLSH

Submit Download

utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq6B63.tmp\utils.dll
Size 178KB
SHA256 837dfd14ee80dd4b09b81431f0ff96dc9dd492b729525485ab74b05da43c4343
MD5 8245b221b5fa70146e9fe5d603867f52
SHA1 36b8ba0d24ebc71dc5174bda9b6619910522b5e1
SHA512 c71ba64b0f61b2a0cb41108d985b3d67a3debad91f296691f122e3f28f5a908cdc94d326e6c20c7bb57f31a52bd464e3f737563d92d802ef266f302dd2c1f6f6
SSDEEP 3072:AYTtzQVBy4xATL7jkflsrRJ6ROrztfuCbuQyVj48E2t7YHjyPscVk:7eVByuABrb6RmfLbuQyjPsn
TLSH
T142048D117480C03AE5AF1631497ADB36563CBA300F75D9DBF7889E3A0EA41C16B35E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download