84bde632c5bfd2a7ff84e579e6f7561543ca0aad6d8e7275dae5926ba4f561c1

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
openiv-4-1.exe
Size 4.4MB
Sample260709-rcmrtscv4w
SHA256 84bde632c5bfd2a7ff84e579e6f7561543ca0aad6d8e7275dae5926ba4f561c1
MD5 1692aec61ddcdda471defa199c62d25a
SHA1 484af221468ddb534b74e12970de80d5dfee2b28
SHA512 19155d0770fc0931ab8ac1bf35f56b32c8c122379adac6866b07cebec28932f92be124638cd7bb9fdaff5edd091f3af0c1fbd0757a99de44e24f11214f13329a
SSDEEP 49152:9Hox6U/D1LbDxklrSWZAhizWV4yFK73bBxaaNNG0pHSdtDLboHTBWpHg6UvM98IQ:2x6qaAVpchNG0pHA57HgR
TLSH
T154265D12B388A53AD07B0E3A487BE754583FBA317E11CC5B6BF44D4C8F3A540693A65B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery trojan

Malware Config

Extracted

Credentials

Protocol
ftp
Host
downloads.ntscorp.ru
Port
21
Username
downloads.ntscorp.ru|anonymous

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	openiv-4-1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openiv-4-1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4780	openiv-4-1.exe
4780	openiv-4-1.exe

C:\Users\Admin\AppData\Local\Temp\openiv-4-1.exe
"C:\Users\Admin\AppData\Local\Temp\openiv-4-1.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OpenIV_Setup_Install.log

Path C:\Users\Admin\AppData\Local\Temp\OpenIV_Setup_Install.log
Size 1KB
SHA256 be3fa104a88c74ebe4336bf198d897867841f58995b095c34bdf948eab3ff7d6
MD5 820ff871cd925712057d8bf340331d86
SHA1 3d85bdb287bf3267ea006f66f1db6540e4e15223
SHA512 74d60cc3fc4fe23546ff8e27285f67c0be9426b744586e5c9796298f1a6c095574c98f955ce36f06649f32543af4f7bbf4c0cd0929701c947b7354b7bf75c19c
TLSH
T1842196A48CBE6176417AF39F01311FC3D5342F264A12282C632658FDB5840CA7EBD7BA
MD5 SHA1 SHA512 TLSH

Submit Download

OpenIV_Setup_Install.log

Path C:\Users\Admin\AppData\Local\Temp\OpenIV_Setup_Install.log
Size 5KB
SHA256 39de51b3089dce2a9ddc92b71532293d7ade535bbb650115d11ac4eaaf739732
MD5 42f4335f88ed1392b0091e1c7ccbadbf
SHA1 271addb19ed6ac14bef27c70cc1c62e28fc38c58
SHA512 c2dc6dc2fa31eea191b7724256ee9b3fbf56c3170783c371de005c7de3dd88ec9baa71f674d7efa1b07aafc10449e780aad764105ac27791e26ef32d6b81797f
SSDEEP 96:wHS6ZH6fQWySejzHbZjy88aM3Mqw8qyYhy:8Za70zHbZgf3Et+
TLSH
T128C1E464CDAAC0728025E29D53161E9BCA36F91B17411DBC919220FDF88118F9F7EFB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenIV_Setup_Install.log

Path C:\Users\Admin\AppData\Local\Temp\OpenIV_Setup_Install.log
Size 849B
SHA256 aa010b1e926934c89e043bf230b70bb5c4421ebcce352aab6089908045e05152
MD5 97ab9866495066710cbac844c61b2f25
SHA1 b088d485f828e792e0bd17be4c830dd7289c48c3
SHA512 fac989258f661406e9ee12cac75b3926baa00ca869ed142e047606c602b3b49aa355834144597c9aa6c5d7a020fe3cfd8acfce2651064aec2a00f346d82f0a2e
TLSH
T18A01D8A48CBE6077457AF25F01310FC3D6392E264A12282C631654FDB5845CF2A7D3A9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4780-0-0x00000000026E0000-0x00000000026E1000-memory.dmp

Download

memory/4780-1-0x0000000000400000-0x0000000000907000-memory.dmp

Download

memory/4780-77-0x00000000026E0000-0x00000000026E1000-memory.dmp

Download

memory/4780-76-0x0000000000400000-0x0000000000907000-memory.dmp

Download

memory/4780-102-0x0000000000400000-0x0000000000907000-memory.dmp

Download