c5e26b88085ad4aa60a434d2554eaaa4f3c4a37aa26b12f40b70fb0c7f6d6a3f

Analysis

user interaction
yes
max time kernel
94s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/07/2026, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NBTExplorer.exe
Size 419KB
Sample260710-tc3t6aex21
SHA256 c5e26b88085ad4aa60a434d2554eaaa4f3c4a37aa26b12f40b70fb0c7f6d6a3f
MD5 7d39ad6228157eba3d4872afeaf042b0
SHA1 48af98d067af2417901a29151ff486ff11cf1bfa
SHA512 0a730945d2194e3fe82620cd5ae8fdd8bac887b42a08aa85ca1eb06f34591c29b2656fa5c30105cbcb938b299741ec3ee4fb5682b58e9d5ef741b1470e365cf5
SSDEEP 6144:HT3HMf+RNxc8/y7ALvLLLIgjjgL6FlvLLLYgjjgL:HG8
TLSH
T147943B013768CD3BC56D4379146541C447BF6C5B909AD68FB880F2EE3AF37626A8B293
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	NBTExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NBTExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	NBTExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NBTExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	NBTExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	NBTExplorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	NBTExplorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	NBTExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	NBTExplorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	NBTExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NBTExplorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NBTExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	NBTExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings	NBTExplorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NBTExplorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	NBTExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NBTExplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	NBTExplorer.exe
Key created	\Registry\User\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\NotificationData	NBTExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	NBTExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	NBTExplorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NBTExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NBTExplorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	NBTExplorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	NBTExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	NBTExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	NBTExplorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NBTExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NBTExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	NBTExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	NBTExplorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	NBTExplorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	NBTExplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NBTExplorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3140	NBTExplorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3140	NBTExplorer.exe

C:\Users\Admin\AppData\Local\Temp\NBTExplorer.exe
"C:\Users\Admin\AppData\Local\Temp\NBTExplorer.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

user.config

Path C:\Users\Admin\AppData\Local\NBTExplorer\NBTExplorer.exe_Url_p4wpy5nvw15pbeomb3ppsypn4v1lngiq\2.8.0.0\user.config
Size 1KB
SHA256 91c8de04ff164d5303750212dbe6db223bdf50aca3da79c0fcda8a35595279d9
MD5 f0ddad7a6110ff1c701cd1391fa86b03
SHA1 67c4bd675ff475b3be7b2c6de4dbad9977ce0eab
SHA512 e568eb7651a874fcce243aaef52e4aa4ac15901812c53ec66a4df5ea507d3e1fa8473f85f4e055b2ce2e0bed93b8af111d3d4b7081553848d29714b00906b9d7
TLSH
T16421EB0861C0A91B02239F32D6618A05DE71839794E529B8F4BC37BBAF314CB038329F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3140-0-0x0000000000AB0000-0x0000000000B1E000-memory.dmp

Download

memory/3140-1-0x0000000002EB0000-0x0000000002F0C000-memory.dmp

Download

memory/3140-2-0x0000000002E50000-0x0000000002E64000-memory.dmp

Download

memory/3140-3-0x000000001CEC0000-0x000000001CED0000-memory.dmp

Download

memory/3140-4-0x000000001CEC0000-0x000000001CED0000-memory.dmp

Download

memory/3140-5-0x000000001CEC0000-0x000000001CED0000-memory.dmp

Download

memory/3140-6-0x000000001CEC0000-0x000000001CED0000-memory.dmp

Download

memory/3140-7-0x000000001CEC0000-0x000000001CED0000-memory.dmp

Download

memory/3140-8-0x000000001CEC0000-0x000000001CED0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads