46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
Size 235KB
Sample260727-e16hmagq71
SHA256 46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042
MD5 8d17b06464f37338ce8b369ceffe5b65
SHA1 d2680a0f70a175ac37afe9d1d4c4824de0d3dad3
SHA512 e365ef022f6003b3e02710523ac40a0cc0b67e79aa613ec55fb8edc28185b66762d9008eb400078a43b519265654aa9574a8e632cf949d59cbab37b1a1274161
SSDEEP 6144:sqjIcRE6w/RSFHMR9aCXGa/NQNbhCkrvCWLN:pVRvw5N9/i/COvj
TLSH
T1DF341266B2E8CA67CB6F52704D3BA591BFE5E3110158174B4B5CBF98BD14E52022F883
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1480	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
1480	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
13	drive.google.com
14	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1480	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
3944	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\rance\karakteriseringens.zip	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1480	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 5044	1480	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe	88
PID 1480 wrote to memory of 3944	1480	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe	89
PID 1480 wrote to memory of 3944	1480	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe	89
PID 3944 wrote to memory of 2880	3944	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe	92

C:\Users\Admin\AppData\Local\Temp\46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
"C:\Users\Admin\AppData\Local\Temp\46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Local\Temp\46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
  "C:\Users\Admin\AppData\Local\Temp\46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe"
  2⤵
  PID:5044
- C:\Users\Admin\AppData\Local\Temp\46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
  "C:\Users\Admin\AppData\Local\Temp\46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Users\Admin\AppData\Local\Temp\46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
    "C:\Users\Admin\AppData\Local\Temp\46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe"
    3⤵
    PID:2880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsd7F9C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsd7F9C.tmp
Size 54B
SHA256 3159fb26988fd82c5a652bdf09e65bb021011a4f8953f009c0a7d893149a9c8e
MD5 8e69760955a717be873f8253ebc6905b
SHA1 c813b0cc54451465777460ef2f46bc98c273c739
SHA512 16de94f841400aeffd2b67ca45e807da10023229f667f746b8fc7b127c347d843ff51b822191e656a94b63d8c8187c928d40113914d34570136c878b64279600
TLSH
T19C90025624814654F582C4711B557008E59D302600C544031A4D44485C05052CA0A5D4
MD5 SHA1 SHA512 TLSH

Submit Download

nsd7F9C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsd7F9C.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsd7F9C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsd7F9C.tmp
Size 39B
SHA256 e9f76c3dcf61068c71c8748639c37793963e1929aca11eed3c2caed692bd17ff
MD5 763ec4bcf1080106283ac75cc79cfdc5
SHA1 e916ad8ee0d278848350e957be6e99f8916c9f0e
SHA512 52273017ba7559aee2f73498b1d277517d2c163ab9eb6891a838664dd4b6ce3a576ae05116deecf502e8494522ce31209dffd2ab68462a75fb841592c83381d2
MD5 SHA1 SHA512

Submit Download

nsd7F9C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsd7F9C.tmp
Size 44B
SHA256 d02310dee3ced92a0be280296fb733c94858c06d62a6eb7fe22cdd38f3fe8ae5
MD5 a11292439456c3877dd223273f88ce2f
SHA1 cbde8e81b850762530c0d960a82eda5ca399e538
SHA512 e4cc180decc607ff549be52de094226d8f2080124fe2e3391a371ab5293294373d910a17f8578dce50ab5e8b20061913f6c378b7258f599a6d9d8ff968f61e7d
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd7FEB.tmp\System.dll
Size 11KB
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
TLSH
T116326D5503504AF3E996863C00263B7FAF796A2095F14D53CFA394C0FE2E5C9AD38352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsd803B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsd803B.tmp
Size 31B
SHA256 b72a8d0c5e5ad95b65023cd1e44ab349802de5a9de5916ee80b21283688cf31b
MD5 e2d76403eed66784967f73bdf3a4899d
SHA1 f14f85137968e20dfc4777fa7534593ba7a8739e
SHA512 5cc1c1cab1cff3aaa8e0d713f394582aff36942a332604580a50324ff65e44d55483ec4c0fe622c4d47e22b29b767e31389c3f9c7be841de9104d8cf9c19d551
MD5 SHA1 SHA512

Submit Download

nsd803B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsd803B.tmp
Size 38B
SHA256 741d56785014197986e36cfb3bb1c79cca24de524bd372658a833b04eee63ae6
MD5 052800c1fa3073cdacbf287ed2de2e7a
SHA1 732cb30ae4a5eb8ac002a68132cb6fc1d5ee0daf
SHA512 7c91f8be77cc0f9f2ba9e22487b8d8ef5c2bf802d0a81b656db1306c5dc5130fd5b6e1420b4289400ad665aee8cd7b244ba45f65a740c401902af94dfeaa1833
MD5 SHA1 SHA512

Submit Download

nsd803B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsd803B.tmp
Size 45B
SHA256 3098893b766a910722e61d591c5c11f74f88279bd7346f19b00c51029377607c
MD5 54731102d5ead255e30373e7f6dcecf3
SHA1 42da2455e92ee40fb7cae2077887b82c29761078
SHA512 29f36510aa3d097d20a0d27e870544f2071e40453327c4ebe151145f8f8082a20ff38fc12e01a605db342fd27c6b560997c85f963ed2c7b2408db5ab53540e34
MD5 SHA1 SHA512

Submit Download

nsd803B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsd803B.tmp
Size 53B
SHA256 650215dac36112f337598117c9bf7170a9e2cf11f5390699a972be48351a2e54
MD5 374e8332edc160f15acd615a0eea212b
SHA1 36ba4763e788af451e77eeb59db01435768f348c
SHA512 472d1cd7f9381354fbf846ddeb5f562f620e384da6a956c41dd95665c4453f0d81b7ad12e21010f276ef37b5b43ef854e93f528a7f8de54c9089be8c3991bb17
TLSH
T17E90021901504AD0368784295F31A128530EA8451C3618120FEC4901B81704A4107109
MD5 SHA1 SHA512 TLSH

Submit Download

nsd803B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsd803B.tmp
Size 56B
SHA256 2881a4475597686e550b42cb34c78ea71ef4016284efc9b904325d9b4c500a54
MD5 3c92fb0ab30f4bc87298ef25b78ba9f5
SHA1 a5f91f7f9799f32192a3f71043e7ab2efd0c9dba
SHA512 f4506a066f739d9ab1150f53870f2854753bff4160c8fe1f60cd249c5bd852971169f7d5a75ac20f2cf3c492a2332f017b39dd9085e9eaaa3a99aec3eb7f3173
TLSH
T14490021901514AD0368784295F31A128531EA8451C3618131FEC4941F82714A420710D
MD5 SHA1 SHA512 TLSH

Submit Download

nsd803B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsd803B.tmp
Size 60B
SHA256 4d93bc9922223510f53dfea3572e7d77a82a85d0782948eb0b962edfb8a867b8
MD5 3f54b69fecf122b3c27d0d626619d50f
SHA1 ab305e3eb089cb979e9f486c3aea7466899867bc
SHA512 2bcd3e42448606e38f52ac3f80d7129bd8ebc78ba681303b6f0de70624dd5488b96c8721b8106a548e02ce24526351352fa21fd21ff593938626ff8c1f503ea8
TLSH
T193A0021941914AD03687842A5F31A128531EB8455C7718131FEC5941F82718E420715D
MD5 SHA1 SHA512 TLSH

Submit Download

nsi800B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsi800B.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

nst809A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst809A.tmp
Size 5B
SHA256 ff91566d755f5d038ae698a2cc0a7d4d14e5273afafc37b6f03afda163768fa0
MD5 e2fecc970546c3418917879fe354826c
SHA1 63f1c1dd01b87704a6b6c99fd9f141e0a3064f16
SHA512 3c4a68cbaee94f986515f43305a0e7620c14c30213d4a17db4a3e8a1b996764eb688bf733f472fc52073c2c80bb5229bb29411d7601aefe1c4370e230c341a0a
MD5 SHA1 SHA512

Submit Download

nst809A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst809A.tmp
Size 26B
SHA256 2e731782503bbf3b2fa333ff6e2da7c873dfeb1d11a25c5e7a013c11fb7028a1
MD5 17425c43be7fbedcbfb1934f0dc3e914
SHA1 8217a08d1c7fdbf5499aa5297e476cf38c12b8a6
SHA512 3a8a521c6c0fd50b15fb086a3bbc9d03b048c06350cc2812f214fcc73720c5f6d931fce0889ed4f36d8f3fb1402ebe2f23167b206e18d969296658d28971aed2
MD5 SHA1 SHA512

Submit Download

nst809A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst809A.tmp
Size 34B
SHA256 08b10130f9a41682df11b40939c3e21623b024023bd00be30f482967f31e76fc
MD5 6a5d37e2828e9c048865b5e8b13a18a7
SHA1 5e677427260b9ef57907699733ac46c0b49d41a4
SHA512 38049efb9720f0b7ca6d949e8012b0f4b3c0adef02a42ba367999f7fd8c0de08a32e9561655935de31e56c487a4bf3f9707d884b9b6030227dd8aa0411281894
MD5 SHA1 SHA512

Submit Download

nst809A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst809A.tmp
Size 56B
SHA256 c0df30fbab2fa581e76023ec90a1e9d5d0d40adcbfdafa2aa6acd3d0d3b6752b
MD5 178a9b4be2b4ef57d9130f23412bd5b6
SHA1 55eddf2bee10dbbe04ef463d49f4a9515c885386
SHA512 3e0f795c113a5005acc632cc3564a651e71a59b7f10c92652a35ac83ec6623b90721ee06813a49f0ef38dcf9b9d5a6b19813829662c749c536b94ff5931b21b2
TLSH
T16590022415957A64F186E8E94D114A4592096505581B14020AE54090B5554C7881A588
MD5 SHA1 SHA512 TLSH

Submit Download

nst8185.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst8185.tmp
Size 10B
SHA256 40ccdff1a037de0fb10d03ea9fe79c2c96e7f18c3c7dffd92b42c2f0ed749116
MD5 fa5eb52a9735c883abcf72a7f9cf2254
SHA1 a043e3d3df1605300a2f5629ad7a302082814956
SHA512 983e3f605f34f74e95db170da28f2584a74bf4d0047ea76c905c409e624d9db2a439e70beb07d8f879fb25549da52bb9cac6304281e2582d6e5b1b4f12ac21f2
MD5 SHA1 SHA512

Submit Download

nst8185.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst8185.tmp
Size 15B
SHA256 384e1fc0d130aa5cbfa9077f6de89b555e096afb67cd2dd827933b992549e69c
MD5 232ea7835f5abeffc769949d0bad82bf
SHA1 d8183e34d3c48afb0f7598a4dc11182218d7e9fe
SHA512 e552cc1f310029859899ab726b70ef38c08026af5e0c125c58e9b31005d8c2fd2d636d8bb3aaf8a039aa3450f058c038186da34b63e883e3613049a6df6905e4
MD5 SHA1 SHA512

Submit Download

nst8185.tmp

Path C:\Users\Admin\AppData\Local\Temp\nst8185.tmp
Size 29B
SHA256 1cd17ebc8f026d74e357291a799786fd75557cfb6752ab682fb941ae1e91dc2a
MD5 8c3ede6c7733ece88212b60aeab2f37e
SHA1 3f0fd925744587ec6cf82b8763d3bc585323aeca
SHA512 8c6c8452744afcd83c14c905a2f100a48cea59c96712747a0a72cfada0d1a1481031bf6cca75113a00deab10ea0222f1965d2d2965eab2ebbf60fac34850c915
MD5 SHA1 SHA512

Submit Download

memory/1480-561-0x00000000742D4000-0x00000000742D5000-memory.dmp

Download

memory/3944-562-0x0000000077678000-0x0000000077679000-memory.dmp

Download

memory/3944-563-0x0000000077719000-0x000000007771A000-memory.dmp

Download

memory/3944-564-0x0000000077695000-0x0000000077696000-memory.dmp

Download

memory/3944-574-0x0000000000450000-0x00000000016A4000-memory.dmp

Download

memory/3944-575-0x0000000077719000-0x000000007771A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads