9b8f13404e8cfb6e90539cd001d948c82752e636f2828098a5c4ac96f317a891

Resubmissions

02/07/2026, 15:52

260702-ta7ekaes6n4

02/07/2026, 15:50

260702-s963eahs2v4

Analysis

user interaction
yes
max time kernel
76s
max time network
79s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/07/2026, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
netmarble_RFonlineNext_A_installer_71732.exe
Size 264KB
Sample260702-s963eahs2v
SHA256 9b8f13404e8cfb6e90539cd001d948c82752e636f2828098a5c4ac96f317a891
MD5 d4c03db3d3b74f8b18739f5ee14bab25
SHA1 7f05d6c6f78ea7b1108616fc08e1ee2705f3ca78
SHA512 4526c368b27062d8ba737a8f1272765b0b26221a41a9c688336f6497b313433b24b53c085be513f13e95aafc0c54090e7c65e6222fefb7c6e5c02d6398ab73ee
SSDEEP 3072:AbG7N2kDTHUpouAw9aXCvLIaSQmjWAKp7w/iu9PdWl7mGCKS2tvhOEA1RJCir86Q:AbE/HU4aaXCTp8I7gFO+2t0EyL+X8BK
TLSH
T1B7447CCB3754B389C4A75B332104B6319F76AB7D18F7C6023D73226AE2324E569539E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
4384	netmarble_RFonlineNext_A_installer_71732.exe
4384	netmarble_RFonlineNext_A_installer_71732.exe
4384	netmarble_RFonlineNext_A_installer_71732.exe
4384	netmarble_RFonlineNext_A_installer_71732.exe
4384	netmarble_RFonlineNext_A_installer_71732.exe
4384	netmarble_RFonlineNext_A_installer_71732.exe
4384	netmarble_RFonlineNext_A_installer_71732.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netmarble_RFonlineNext_A_installer_71732.exe

C:\Users\Admin\AppData\Local\Temp\netmarble_RFonlineNext_A_installer_71732.exe
"C:\Users\Admin\AppData\Local\Temp\netmarble_RFonlineNext_A_installer_71732.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm6EE3.tmp\INetC.dll
Size 25KB
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
TLSH
T1F0B2F99257EA179AF7BAAB3478B9E762497FBC211821CCCF5533068D1872241ED30727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm6EE3.tmp\nsJSON.dll
Size 23KB
SHA256 64b3efdf3de54e338d4db96b549a7bdb7237bb88a82a0a63aef570327a78a6fb
MD5 f4d89d9a2a3e2f164aea3e93864905c9
SHA1 4d4e05ee5e4e77a0631a3dd064c171ba2e227d4a
SHA512 dbda3fe7ca22c23d2d0f2a5d9d415a96112e2965081582c7a42c139a55c5d861a27f0bd919504de4f82c59cf7d1b97f95ed5a55e87d574635afdb7eb2d8cadf2
SSDEEP 384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
TLSH
T1D4B21746A6B054F4F57B55BAB4322E232E7EBD08286095EFC73319196860913BB3D333
MD5 SHA1 SHA512 SSDEEP TLSH