195135e212f63be55e5dc42db37b2ea68b8ab0864910ebd7e7e06b79d3b58de8

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
195135e212f63be55e5dc42db37b2ea68b8ab0864910ebd7e7e06b79d3b58de8.exe
Size 1.7MB
Sample260724-twypjsgp8w
SHA256 195135e212f63be55e5dc42db37b2ea68b8ab0864910ebd7e7e06b79d3b58de8
MD5 4de7b7ea0ec19f9a6b24e5e6a06e432f
SHA1 6579e7491edf78a78217307e7cdb7c4626b2575c
SHA512 6eca541aa3d0e9cfaee335e45a5e77addca0f7b0ff25f941cee074fd2180ba205ac256fef78fac9b2615930fde512386f870bd3972da65145df84e413491b85e
SSDEEP 49152:H1NkpDyje1TXG2zKygwrNcR6AMD+6+5TIEFc7gQ0N+Tu:H1ygje1rKTwrNc0foVFc7V0N+y
TLSH
T1F085330136418EABF52731386E7D236737BEBC45527A491F776D03B93C10A85EA4B32A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1972	195135e212f63be55e5dc42db37b2ea68b8ab0864910ebd7e7e06b79d3b58de8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	195135e212f63be55e5dc42db37b2ea68b8ab0864910ebd7e7e06b79d3b58de8.exe

C:\Users\Admin\AppData\Local\Temp\195135e212f63be55e5dc42db37b2ea68b8ab0864910ebd7e7e06b79d3b58de8.exe
"C:\Users\Admin\AppData\Local\Temp\195135e212f63be55e5dc42db37b2ea68b8ab0864910ebd7e7e06b79d3b58de8.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi2513.tmp\nsDialogs.dll
Size 9KB
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
TLSH
T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download