962feec7fc758391ebee2836f56f240b633ef5ac4708a66b003d37cf6c5f712c

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bandizip_7.45.0.0_X64.exe
Size 7.3MB
Sample260722-vm73asdm21
SHA256 962feec7fc758391ebee2836f56f240b633ef5ac4708a66b003d37cf6c5f712c
MD5 2630185b918869a902085442f4c5ba1c
SHA1 1f1a9a48df43ec65788b58972c4bef6a09ceed24
SHA512 4db9246731c58433a22e8532524b66e0b71c0db6c836812f1064795ea5be9a600d174b0e7d82a0ae138c1e4fc34f19dbca0f68eda07b061216592d475557a993
SSDEEP 196608:dXHqhAWyH92YQnOI1/PqRHFyPswAYHDkRPPVYXi2:d/HPQOINitcvCO
TLSH
T1117623237EE0F471C17266B076AB83BCA5F2F8620435954B23E18A1D6E78990D73D772
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2160	BANDIZIP-SETUP-STD-X64.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bandizip_7.45.0.0_X64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BANDIZIP-SETUP-STD-X64.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5268 wrote to memory of 2160	5268	Bandizip_7.45.0.0_X64.exe	89

C:\Users\Admin\AppData\Local\Temp\Bandizip_7.45.0.0_X64.exe
"C:\Users\Admin\AppData\Local\Temp\Bandizip_7.45.0.0_X64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5268
- C:\Users\Admin\AppData\Local\Temp\nsaF653.tmp\BANDIZIP-SETUP-STD-X64.EXE
  "C:\Users\Admin\AppData\Local\Temp\nsaF653.tmp\BANDIZIP-SETUP-STD-X64.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BANDIZIP-SETUP-STD-X64.EXE

Path C:\Users\Admin\AppData\Local\Temp\nsaF653.tmp\BANDIZIP-SETUP-STD-X64.EXE
Size 7.1MB
SHA256 46ad5dc599b9a7f036c0b890dbaaa8dd0cecedbd4fa3243f0faf512e2ed62394
MD5 59597b8c806ea542ddc8e64a87750e68
SHA1 075054d72fb506b9de4b49f9c38f6a6f65d54fad
SHA512 5755ea962d2b62d9f132dbf4293aa0a2d9741419accd6f19aa58f4e595ccabd304d13345cbae6bee70c201fedd5cb51b611af68d17a0e14ad3445b495eb9b535
SSDEEP 196608:bHqhAWyH92YQnOI1/PqRHFyPswAYHDkRPPVYXC:rHPQOINitcvCL
TLSH
T1987623237EE0F475C17376B076AAC3ADA4F2F8A10435944B22E18A1D6E78990D73D772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2160-5-0x0000000002260000-0x0000000002261000-memory.dmp

Download

memory/2160-17-0x0000000002260000-0x0000000002261000-memory.dmp