b1d4bd76b41f32d08287bf043b3dc8c798a145c02319217d45a74b0d9545a23d

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
openconnect-gui-1.5.3-win32.exe
Size 22.6MB
Sample260707-pg4j2aey6k
SHA256 b1d4bd76b41f32d08287bf043b3dc8c798a145c02319217d45a74b0d9545a23d
MD5 e7c6c332c837f5cfb6c358361002a2f5
SHA1 83365898f0deb9ad86599ab3bad05cf2c0f9ab73
SHA512 2055a303ed6a40a0267203bc3c3d4ad14c86f7d690ab3cc85918ff0afc2103b1ca985e28f9e1efa92fb7b3cb41cd0add02aac9439a83b9b42e29e5bd01bff621
SSDEEP 393216:hqontkN/S7+F4rxu30jgoM4EQQq2GJJvawfEWEjlSmZFY1ewMg16SNKltxSpmOQ:hqotkJ++uW0jvMSDJJ1fdg9HK7MCbNKN
TLSH
T1DC3733527340D81BD2590AF186B5D3B65326BCA656D3468B3DC9FFA73A30787EC6808C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1552	openconnect-gui-1.5.3-win32.exe
1552	openconnect-gui-1.5.3-win32.exe
1552	openconnect-gui-1.5.3-win32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openconnect-gui-1.5.3-win32.exe

C:\Users\Admin\AppData\Local\Temp\openconnect-gui-1.5.3-win32.exe
"C:\Users\Admin\AppData\Local\Temp\openconnect-gui-1.5.3-win32.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nslEC51.tmp\InstallOptions.dll
Size 14KB
SHA256 e625dcd0188594b1289891b64debddeb5159aca182b83a12675427b320bf7790
MD5 8d5a5529462a9ba1ac068ee0502578c7
SHA1 875e651e302ce0bfc8893f341cf19171fee25ea5
SHA512 101da2c33f47bd85b8934318e0f0b72f820afc928a2a21e2c7823875e3a0e830f7c67f42b4c2f30596eaa073617790c89700c0d95b7949ec617e52800b61d462
SSDEEP 192:W4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjAK72dwF7dBOne:3n3T5KdHCMRD/R1cOnrjA+BO
TLSH
T134622A55738488F3DBE2003E785237079B995565B492AED2CE275FCA687B08D7EB2303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSIS.InstallOptions.ini

Path C:\Users\Admin\AppData\Local\Temp\nslEC51.tmp\NSIS.InstallOptions.ini
Size 745B
SHA256 d99d7da44b76e0a1f537331cb5e8ebea508d6b64d968f1172676dda7fb36bb1b
MD5 b6bfeb326baeff4641ce5c14625a1819
SHA1 eb38d329ab1c8d51f425203551c2ca3395a24eab
SHA512 7cee29a114955f8af072e475941bf760059b5b74b917e2b731eec35de1a1eababec9c2ef57acea1abcb05d3b399c802831d3b648de8c76ab6af7e8fa340ca2fc
TLSH
T16401F548A01683699131D21114EF62F8BBD0386E568529D0F3A804C3DB95EEB89FD5EE
MD5 SHA1 SHA512 TLSH

Submit Download

NSIS.InstallOptions.ini

Path C:\Users\Admin\AppData\Local\Temp\nslEC51.tmp\NSIS.InstallOptions.ini
Size 758B
SHA256 7aeb9b22363e0d4a32ddc6e3b4ab78503519ec4d1c32c87fc341cbc9394b66f1
MD5 89d110b423443e2d1905cdcbcfb1632d
SHA1 04a2138fa85e967c43d9ff48eeac6dc6be9abc8f
SHA512 2830f715910ff4fa856cee109ad6fa135d8b8359f88394073ab65d8446f32b1ee8900469acde329d3fb441f9793516b2bca0ba94dd7b3b7ced74faea69bdc320
TLSH
T1C1014548A00683799031C25114EF62F8BBD0382E568529D0F3A804C3CBD5EEB89FD1EE
MD5 SHA1 SHA512 TLSH

Submit Download

NSIS.InstallOptions.ini

Path C:\Users\Admin\AppData\Local\Temp\nslEC51.tmp\NSIS.InstallOptions.ini
Size 693B
SHA256 196d65eb07b461e36620c552c22f1af73e34f006dc3e75ef34ec03c475f23420
MD5 afbbf6496031952e5c7473916d74791b
SHA1 be03f8e069656ce9461d6fa8354b3d01121335c9
SHA512 865c2e2e46483b163b4b5973e4e64ab3ddf468a9468e60b2e5414c31c6b447b774fed087b70b413e7201eff305aad2e2f7ee3a48c04ed781b963bfe8d191ba1f
TLSH
T19001F748A00283399131D21114FF62F8BBD03C2E264229D0B3EC08C3DB95EEA59FD1FA
MD5 SHA1 SHA512 TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nslEC51.tmp\UserInfo.dll
Size 4KB
SHA256 0073337816509851476c2cc154f471a3e3a1a2806b97c363870acc09a30a5ed7
MD5 dada3e1836af78d5b24499da252d01e4
SHA1 d2a1c25405e3c74973cf18dec2c7138df9e96a83
SHA512 f8bda8413dadb00a644341da5e076f203a3134daaefd2961fa0341f5a533eee28582ce9872354ead698bb1275ee7726fa574267e909a3e2f977908392e7a5c66
TLSH
T19A81717B62A80CF3C0940BBB41D71CA71376DC702793011E99470E9A34C4AAFED6E705
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nslEC51.tmp\ioSpecial.ini
Size 721B
SHA256 6676b5f1bb86ac47939c0293cfd981907506c4d55fe3b4f70ca7276bb21adf62
MD5 43335dd0747fbb5b3f93aacfc5eeef53
SHA1 9dec574fd404b9ca14662b2527f177fce9e5b808
SHA512 fd094f52471945a4d6064ba3a742fc67b9bbee3c32ee162df51011929fa15e36ac90b245918f0a4849ae92491673e3bb4540d58d9b1909b839ff31e3c26cdddc
TLSH
T12C019CC9541FA3A8042410D664A937A167E01C288B213CF6E05298869388DD78AEDED3
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads