46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
Size 235KB
Sample260727-e16hmagq71
SHA256 46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042
MD5 8d17b06464f37338ce8b369ceffe5b65
SHA1 d2680a0f70a175ac37afe9d1d4c4824de0d3dad3
SHA512 e365ef022f6003b3e02710523ac40a0cc0b67e79aa613ec55fb8edc28185b66762d9008eb400078a43b519265654aa9574a8e632cf949d59cbab37b1a1274161
SSDEEP 6144:sqjIcRE6w/RSFHMR9aCXGa/NQNbhCkrvCWLN:pVRvw5N9/i/COvj
TLSH
T1DF341266B2E8CA67CB6F52704D3BA591BFE5E3110158174B4B5CBF98BD14E52022F883
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4996	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
4996	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	drive.google.com
1	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4996	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
2636	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\rance\karakteriseringens.zip	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4996	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 3280	4996	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe	89
PID 4996 wrote to memory of 2636	4996	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe	90
PID 4996 wrote to memory of 2636	4996	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe	90
PID 2636 wrote to memory of 5548	2636	46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe	91

C:\Users\Admin\AppData\Local\Temp\46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
"C:\Users\Admin\AppData\Local\Temp\46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
  "C:\Users\Admin\AppData\Local\Temp\46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe"
  2⤵
  PID:3280
- C:\Users\Admin\AppData\Local\Temp\46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
  "C:\Users\Admin\AppData\Local\Temp\46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\AppData\Local\Temp\46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe
    "C:\Users\Admin\AppData\Local\Temp\46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042.exe"
    3⤵
    PID:5548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsh808.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsh808.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

nsh8A6.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsh8A6.tmp
Size 56B
SHA256 c0df30fbab2fa581e76023ec90a1e9d5d0d40adcbfdafa2aa6acd3d0d3b6752b
MD5 178a9b4be2b4ef57d9130f23412bd5b6
SHA1 55eddf2bee10dbbe04ef463d49f4a9515c885386
SHA512 3e0f795c113a5005acc632cc3564a651e71a59b7f10c92652a35ac83ec6623b90721ee06813a49f0ef38dcf9b9d5a6b19813829662c749c536b94ff5931b21b2
TLSH
T16590022415957A64F186E8E94D114A4592096505581B14020AE54090B5554C7881A588
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm7D8.tmp\System.dll
Size 11KB
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
TLSH
T116326D5503504AF3E996863C00263B7FAF796A2095F14D53CFA394C0FE2E5C9AD38352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsn963.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsn963.tmp
Size 29B
SHA256 1cd17ebc8f026d74e357291a799786fd75557cfb6752ab682fb941ae1e91dc2a
MD5 8c3ede6c7733ece88212b60aeab2f37e
SHA1 3f0fd925744587ec6cf82b8763d3bc585323aeca
SHA512 8c6c8452744afcd83c14c905a2f100a48cea59c96712747a0a72cfada0d1a1481031bf6cca75113a00deab10ea0222f1965d2d2965eab2ebbf60fac34850c915
MD5 SHA1 SHA512

Submit Download

nsr847.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsr847.tmp
Size 60B
SHA256 4d93bc9922223510f53dfea3572e7d77a82a85d0782948eb0b962edfb8a867b8
MD5 3f54b69fecf122b3c27d0d626619d50f
SHA1 ab305e3eb089cb979e9f486c3aea7466899867bc
SHA512 2bcd3e42448606e38f52ac3f80d7129bd8ebc78ba681303b6f0de70624dd5488b96c8721b8106a548e02ce24526351352fa21fd21ff593938626ff8c1f503ea8
TLSH
T193A0021941914AD03687842A5F31A128531EB8455C7718131FEC5941F82718E420715D
MD5 SHA1 SHA512 TLSH

Submit Download

nsw779.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsw779.tmp
Size 48B
SHA256 46cc3e4da899bd4967072208983b1cc3f7bbfdac794a908d90e14f8dc97dd780
MD5 db255f53108568593d80f2b9196f73d5
SHA1 e00bde519e33311332599680b51d6c4bdda77f8f
SHA512 5b1032ca47c32dd2d23230ad83b1ccd2f74139b7c2da086140c93896f56cc65345c25f57cd54427e5786b4cb3ec675ad10184c8018a0e11118a580a1b3c68e87
MD5 SHA1 SHA512

Submit Download

nsw779.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsw779.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2636-562-0x000000007760F000-0x0000000077610000-memory.dmp

Download

memory/2636-563-0x00000000775CD000-0x00000000775CE000-memory.dmp

Download

memory/2636-564-0x0000000077695000-0x0000000077696000-memory.dmp

Download

memory/2636-574-0x0000000000450000-0x0000000001736000-memory.dmp

Download

memory/2636-575-0x0000000077695000-0x0000000077696000-memory.dmp

Download

memory/4996-561-0x00000000742B4000-0x00000000742B5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads