Overview
overview
7Static
static
3c7e9f0987f...c3.exe
windows10-2004-x64
7c7e9f0987f...c3.exe
windows11-ltsc_2024-x64
7$PLUGINSDIR/LogEx.dll
windows10-2004-x64
3$PLUGINSDIR/LogEx.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...SC.dll
windows10-2004-x64
3$PLUGINSDI...SC.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 09:08
Static task
static1
Behavioral task
behavioral1
Sample
c7e9f0987f8c483a381c8ad7b7b50b612857458eede418c3f0b549422b8273c3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
c7e9f0987f8c483a381c8ad7b7b50b612857458eede418c3f0b549422b8273c3.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LogEx.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LogEx.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
General
- Target c7e9f0987f8c483a381c8ad7b7b50b612857458eede418c3f0b549422b8273c3.exe
- Size 619KB
- Sample260714-k3vf2act2z
- SHA256 c7e9f0987f8c483a381c8ad7b7b50b612857458eede418c3f0b549422b8273c3
- MD5 6157a8eed974d420cf283200c8cc57dd
- SHA1 cfec77fcd9098efd20cc6c57b18f29f0bb6f0a37
- SHA512 82d93b5e16623201466a5f8b559324e671bf184532c411cfc981de4bd9fd64711a77ad4a64a4b81543bbed8b483774f34a0f91087b6d738ad4c504f7935d5d0b
- SSDEEP 12288:MfLuOii3+EO5HR03nKx/K8j2C/PgAI6A1sAM:MfLuOii3+EO5HR0Xz8jDvAW/
- TLSH T1EFD4F0F3E40098DAF5BB35B50ED5BD53C695232C75E02A5BDAEC6A58D4232610CCEF28
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2440 Un.exe - Executes dropped EXE 1 IoCs
pid Process 2440 Un.exe - Loads dropped DLL 26 IoCs
pid Process 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c7e9f0987f8c483a381c8ad7b7b50b612857458eede418c3f0b549422b8273c3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Un.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe 2440 Un.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1224 wrote to memory of 2440 1224 c7e9f0987f8c483a381c8ad7b7b50b612857458eede418c3f0b549422b8273c3.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7e9f0987f8c483a381c8ad7b7b50b612857458eede418c3f0b549422b8273c3.exe"C:\Users\Admin\AppData\Local\Temp\c7e9f0987f8c483a381c8ad7b7b50b612857458eede418c3f0b549422b8273c3.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe"C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2440
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nscAF13.tmp\SimpleSC.dll
- Size 1.1MB
- SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
- MD5 7b89329c6d8693fb2f6a4330100490a0
- SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
- SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
- SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
- TLSH T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nscAF13.tmp\StdUtils.dll
- Size 98KB
- SHA256 4787e95796035dda92a6cbff56ffddde5ace96f5e46f0f40d2998189ccd6e7ce
- MD5 b7f044787bb5a0c1eb43907c061c1ac0
- SHA1 84675f05e0e406482a688c61e0dee35b9a8fb390
- SHA512 7f0ebc15ee74050a8b493f2c944fc6551056efedde60193be76d4115d28b10f06cc9a859cb42135deee56d614d2ca90e432627f30432d303320dd41fc7fcde6f
- SSDEEP 1536:1k3Dhu2n/PaONjb0GCDeTF7Rqh7AG2gCf46Q6K3le45Gq:CNu2n/SOx0hDeTF7Rqh7Bl2K3lefq
- TLSH T1DAA35C61A2FAACF5E1E70A3C146AB65A4DB77F382434CDAF2302410F9934642DA6D357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nscAF13.tmp\System.dll
- Size 12KB
- SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- MD5 4add245d4ba34b04f213409bfe504c07
- SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
- TLSH T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nscAF13.tmp\nsProcess.dll
- Size 4KB
- SHA256 51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257
- MD5 88d3e48d1c1a051c702d47046ade7b4c
- SHA1 8fc805a8b7900b6ba895d1b809a9f3ad4c730d23
- SHA512 83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7
- TLSH T1EC81533203E429F6C5C90F73254799F3A376CE3417A55A1F4993D71A26486ABEE3D302
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe
- Size 619KB
- SHA256 c7e9f0987f8c483a381c8ad7b7b50b612857458eede418c3f0b549422b8273c3
- MD5 6157a8eed974d420cf283200c8cc57dd
- SHA1 cfec77fcd9098efd20cc6c57b18f29f0bb6f0a37
- SHA512 82d93b5e16623201466a5f8b559324e671bf184532c411cfc981de4bd9fd64711a77ad4a64a4b81543bbed8b483774f34a0f91087b6d738ad4c504f7935d5d0b
- SSDEEP 12288:MfLuOii3+EO5HR03nKx/K8j2C/PgAI6A1sAM:MfLuOii3+EO5HR0Xz8jDvAW/
- TLSH T1EFD4F0F3E40098DAF5BB35B50ED5BD53C695232C75E02A5BDAEC6A58D4232610CCEF28
- MD5 SHA1 SHA512 SSDEEP TLSH