b2e988c00675d24fece5428547126d87e8a6b9d599c2a30d810d5b41c1ba84ba

Analysis

user interaction
yes
max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PSNMLite2020.1.exe
Size 17.6MB
Sample260720-c4678acy4l
SHA256 b2e988c00675d24fece5428547126d87e8a6b9d599c2a30d810d5b41c1ba84ba
MD5 68e98230857eaf6ae86a1e8f3985953b
SHA1 eaa240f9a2f46350788b71a85b6b9cff33e779d5
SHA512 b1d99c935625f0866e3293925e2777ca7d195e547650f6f1641fc753cb01a5a59f5307aa9162416f9d30cbd61c2a9f29c7de16cfbc31ab47a7b5b833f4f2994d
SSDEEP 393216:fqR9UkTStpcTuAzabtEbg6vRVfWJ2lurs7WZfflTRB/fd7GS:fwQ6S16RVOiurNfl7fdiS
TLSH
T14E073384FCD188F1F6A1857A81FBF6ED7E50FFC800864919EBB459816EB5CE04933A94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5060	GLBDC32.tmp

Loads dropped DLL 1 IoCs

pid	Process
5060	GLBDC32.tmp

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	GLBDC32.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PSNMLite2020.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GLBDC32.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 5060	4564	PSNMLite2020.1.exe	89

C:\Users\Admin\AppData\Local\Temp\PSNMLite2020.1.exe
"C:\Users\Admin\AppData\Local\Temp\PSNMLite2020.1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\GLBDC32.tmp
  C:\Users\Admin\AppData\Local\Temp\GLBDC32.tmp 6144 C:\Users\Admin\AppData\Local\Temp\PSNMLI~1.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GLBDC32.tmp

Path C:\Users\Admin\AppData\Local\Temp\GLBDC32.tmp
Size 70KB
SHA256 811a48df57ea1a85f737306994e4f648fb5ddde3c502fdce126f6ecc9f97a20f
MD5 e8cb53b392f57d7e1fea5463ab72865a
SHA1 1fa624cf2889cde18561f4be8ce20db6ca5142a3
SHA512 539ad16e8320b3467ceb88fc05789f6c41d3796f526b6a136fbf271e302d5a3ebaeb821bb7899d82d451f222bb7f4290f988ecd8c07409742a5f15161e414896
SSDEEP 1536:3m69v5i/XaUK4jYFpe+rlTALCjsUXplPG7:3mohcaR4elTALIpQ7
TLSH
T1FF639E053C80C773C81594705966C2A48FAFE8127AA9899BFF9C1F9F4E711D09B3633A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GLCDD7A.tmp

Path C:\Users\Admin\AppData\Local\Temp\GLCDD7A.tmp
Size 188KB
SHA256 739105d5981cdb3040a184c28f7d7bfaf0eabf2529fa81f5697cb7c42ba0e784
MD5 b285c45a315f4e85a94962151c5f2b09
SHA1 c0daee3a412678988fa1a9325c52cdca102e1711
SHA512 ed3ea4018fb1bd2859e8ebb74f0ab71f45096b687218ff748f6d581737385cc79b35940a2f6bbc2913d9ddec0902d168b5fd903729fce20ea83922bc4756d7b6
SSDEEP 3072:gz02Vb1SoQgFrCjZJcbZD+vc7xOZRpi6t3nB3Tw7ObZMTrSwQbCH3BSb:gDVJSoQgFejLYZD+vc7xOZRpiS3xyObf
TLSH
T1C7148E197185D037D727003DC877A7728A7DB8600B6E69E3EBD909E45FE16C69E28383
MD5 SHA1 SHA512 SSDEEP TLSH