a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe
Size 943KB
Sample260720-qs6dfaby5r
SHA256 a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04
MD5 94cb6fa33a286b6e283f7955e1cbf62d
SHA1 6444103c3add87fc2ec252790932fb428ec76fbf
SHA512 ede6e490725dc2f7e3f639461925a9bdfdb09ca4f10232d4fb3eee9036e43d56bf137df6b9a1bbeaa206a8ac629044e52bbdfbd1bf254bb7b71f7dfd7920bd12
SSDEEP 24576:oA7F7uC9LPvhdBuylMeBEFmNZpJGSqQc3DKtbPik+v:oUuCR7BHrDHVSKtTik+v
TLSH
T143252398F375831FE855D371C8BA8A60CB78AC6C3449960F6345B1A63CB37CA46153EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3400	a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe
3400	a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
6	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3400	a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe
936	a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\slagterknive\kofferdammens.ini	a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3400	a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 4348	3400	a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe	89
PID 3400 wrote to memory of 936	3400	a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe	90
PID 3400 wrote to memory of 936	3400	a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe	90
PID 936 wrote to memory of 3696	936	a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe	91

C:\Users\Admin\AppData\Local\Temp\a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe
"C:\Users\Admin\AppData\Local\Temp\a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Users\Admin\AppData\Local\Temp\a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe
  "C:\Users\Admin\AppData\Local\Temp\a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe"
  2⤵
  PID:4348
- C:\Users\Admin\AppData\Local\Temp\a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe
  "C:\Users\Admin\AppData\Local\Temp\a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Users\Admin\AppData\Local\Temp\a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe
    "C:\Users\Admin\AppData\Local\Temp\a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04.exe"
    3⤵
    PID:3696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsdB42.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsdB42.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsdC2F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsdC2F.tmp
Size 60B
SHA256 dfc506e3141ae14cf5a877c827b5d7cf5bc5f80065dc996c78f9d86ac2caa7ce
MD5 cb14370b0ec55cc1dcbcec1896b82bdb
SHA1 19f2a2396b17dcfc5a4a74f1acb5a08fd10b83b3
SHA512 3576ed1280a749167c61f5d4d8ca9a7fc2599ef0d3cc373967a88d2b57030220d571c69a22155a864e2b520b30c7fb0c35fddd3777a3d0b507b2893385c93e3d
TLSH
T1E2A00229418549D0275784279E31A2245319BC954C7A04123BBC5641B41354E4303159
MD5 SHA1 SHA512 TLSH

Submit Download

nsjCED.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsjCED.tmp
Size 29B
SHA256 1cd17ebc8f026d74e357291a799786fd75557cfb6752ab682fb941ae1e91dc2a
MD5 8c3ede6c7733ece88212b60aeab2f37e
SHA1 3f0fd925744587ec6cf82b8763d3bc585323aeca
SHA512 8c6c8452744afcd83c14c905a2f100a48cea59c96712747a0a72cfada0d1a1481031bf6cca75113a00deab10ea0222f1965d2d2965eab2ebbf60fac34850c915
MD5 SHA1 SHA512

Submit Download

nsoC1F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsoC1F.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nstB53.tmp\System.dll
Size 12KB
SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 81e268e27dbbcadbf116b5a9402195ab
SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
TLSH
T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nstC8E.tmp

Path C:\Users\Admin\AppData\Local\Temp\nstC8E.tmp
Size 56B
SHA256 a9e153590ee038551a3411da8b52af57313dde8a139aacb0b84b58346178e3f9
MD5 439ac49b20beec13044902fd56c044a7
SHA1 72805195319ffec949f91cd714f7050ab2dde757
SHA512 c5d754b7d04b2b69da2ed3f8cfd9f6687d8354d6e27fe108823e20a0bfcf9223c09504f93b4fa6327f656767b0a502e1093bb057fbd97c4af842006afbdf253b
TLSH
T1C590022419856968E256ECE58C214A459109A5555C1F040126654190714148F8516944
MD5 SHA1 SHA512 TLSH

Submit Download

memory/936-573-0x000000007778F000-0x0000000077790000-memory.dmp

Download

memory/936-574-0x000000007774D000-0x000000007774E000-memory.dmp

Download

memory/936-575-0x0000000077815000-0x0000000077816000-memory.dmp

Download

memory/936-587-0x0000000000480000-0x0000000001766000-memory.dmp

Download

memory/936-588-0x0000000077815000-0x0000000077816000-memory.dmp

Download

memory/3400-572-0x0000000074415000-0x0000000074416000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads