1d89b9af683a595ade1414551c9791edfc6c1346bded1ed28539421b8559c329

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1d89b9af683a595ade1414551c9791edfc6c1346bded1ed28539421b8559c329.exe
Size 2.5MB
Sample260719-3a3wtafv8l
SHA256 1d89b9af683a595ade1414551c9791edfc6c1346bded1ed28539421b8559c329
MD5 eb9cbffd8ee00370dac666116c26c5dd
SHA1 059665e530601c040891399a86296af9361fc133
SHA512 f3260539147da8a9e5890521b7e57b3a16a7ba1c7437934ef8f56d61581e4c9da4e0a626869680fe175d1a094851b6a54394d5ce06cd5fe7cc804e907fcee5e5
SSDEEP 49152:pVV1Atn/SDy7bdzekazdNXTnIpDiQEZtxaIesuHONgxMHOVLm3oB:3V4n/wmb0nhNjIpDrEZ5esu0w
TLSH
T19AC5336A50959C5FDC3127BA2A77C848FEADA40A89C8D3978B307E143ECFA50571E734
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3544	1d89b9af683a595ade1414551c9791edfc6c1346bded1ed28539421b8559c329.exe
3544	1d89b9af683a595ade1414551c9791edfc6c1346bded1ed28539421b8559c329.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1d89b9af683a595ade1414551c9791edfc6c1346bded1ed28539421b8559c329.exe

C:\Users\Admin\AppData\Local\Temp\1d89b9af683a595ade1414551c9791edfc6c1346bded1ed28539421b8559c329.exe
"C:\Users\Admin\AppData\Local\Temp\1d89b9af683a595ade1414551c9791edfc6c1346bded1ed28539421b8559c329.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GID5.F

Path C:\Users\Admin\AppData\Local\Temp\GID5.F
Size 2.6MB
SHA256 ae1ff4c32a241da68c9dc33f405d9592a9c4eb0cb5ec94c0e6b67b36fd9ada53
MD5 d7f54d8220a96cdf509637f418ebcfa6
SHA1 66a7eb9acc839d26b0e24ce0c09ef86596590125
SHA512 e2991004f01688ced66338e95df67e99249e9196c342628a2386951d143ed73aa9430ffebf27bf989f1995f623c068e83fc845c0b07d82ec4c0b3297b473c794
SSDEEP 49152:eGV/fF03Z4VxnHPV6+C1y4PR2gA59LxIlsFQ1gd1oQsTSKY:bAZ4VBvNCU+RoHlERgdZsHY
TLSH
T1B0C5127DA582F0EFF7CBC539326973DA695B285140283179ABA0F1E44A790A4F4F2D31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsUnzip.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd6420.tmp\nsUnzip.dll
Size 146KB
SHA256 4e4e429ecf1c49119a21c817899f64152b03b41b036fc1d92aee335043364c43
MD5 77a26c23948070dc012bba65e7f390aa
SHA1 7e112775770f9b3b24e2a238b5f7c66f8802e5d8
SHA512 2e7ffa4ed5c97f555e1b0d6f55ffcfd53cd28302fc77d95fdaea89e0b6b42e67e366331e52358e78e8266d079cc2ca3ea4c909197fb38a5b4c8151c7678d0065
SSDEEP 3072:3imoHcJg67rm+2X7jiYwJAmcxaw2VvnCNizd9XER4I6CAZJPtAY3:3I8Jlrm7SnjCNizdhER4I3kP3
TLSH
T195E3BF0A389088B3EC8E533E58560F199B76E05B26D4D566B3DC99D82F187D0DEBE307
MD5 SHA1 SHA512 SSDEEP TLSH