3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe
Size 380KB
Sample260727-ejskfahb58
SHA256 3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c
MD5 34d72fc49349b9bfe03f2504b84bbb56
SHA1 293d42eb87b9f71cef073e1f88a0030ba6b2d5aa
SHA512 e6df70323727c87ddaa8209c94f90d9f71fcab6686439eb1c522add445793d746adba33aea4af5756ff217fdc2e858d9db20cb9da35efc5a9d19414dc8f92233
SSDEEP 6144:BbE/HUe3Y0VKlgggggggggoFJs7oz9GeKlz7QO6KVNqZLi6M3lEMANpW2N+2uE3w:BbcVKlgggggggggoFJs0afzPqZGzlUsx
TLSH
T1AE8412B435B0E551E8A10232E425EE3E1FB89D5ED4795E8B130CBFBDBAF1683A41D102
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
5660	3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe
5660	3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
4	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5660	3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe
3736	3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\mogens\gerans.txt	3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\sexfirma.lnk	3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5660	3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5660 wrote to memory of 4356	5660	3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe	90
PID 5660 wrote to memory of 3736	5660	3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe	91
PID 5660 wrote to memory of 3736	5660	3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe	91
PID 3736 wrote to memory of 1768	3736	3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe	92

C:\Users\Admin\AppData\Local\Temp\3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe
"C:\Users\Admin\AppData\Local\Temp\3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5660
- C:\Users\Admin\AppData\Local\Temp\3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe
  "C:\Users\Admin\AppData\Local\Temp\3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe"
  2⤵
  PID:4356
- C:\Users\Admin\AppData\Local\Temp\3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe
  "C:\Users\Admin\AppData\Local\Temp\3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Users\Admin\AppData\Local\Temp\3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe
    "C:\Users\Admin\AppData\Local\Temp\3e13c0ace9f009cd692ccbe6dde3fcd7f0efc419af8e40fcb47af3f99d36071c.exe"
    3⤵
    PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nscFB83.tmp

Path C:\Users\Admin\AppData\Local\Temp\nscFB83.tmp
Size 59B
SHA256 5745e24f1d2217560ffd59274adb500eb2b350a3fcc86cda4e6181fbe4f96ece
MD5 42d9107b0a7dcefc04b2f720704232c6
SHA1 c1d191f3c1f96b4d587f76a5335bd52a53521748
SHA512 9b2d770cccc6966625fc63e6c8eb4410a35d656710494851ab4f5f6e94427819b1197370b54be88ad1f4fed76fe7a005e03314a87e69d6876940c8c0eacc5904
TLSH
T101A0025635814654FD82C4711B65700CE59D302600C544031A4D44485D05067CA0A5D4
MD5 SHA1 SHA512 TLSH

Submit Download

nscFB83.tmp

Path C:\Users\Admin\AppData\Local\Temp\nscFB83.tmp
Size 19B
SHA256 84911471a6124a186d240b3b67eed83ba5a0a7cb911eefc790712d936c83d568
MD5 a82a5da452642ddab3a7ee07f7c408df
SHA1 cf937f2e7e57c21beaf57a2b7e0c4b77f37c63f7
SHA512 73ed822f62f762e6e8902b4a5c31ea9a0501926d2dd512f5e5285d39fa8b31e82e61294c99c341e0f2046d0cb0351396e8d97afc0ddc71d37c9b680cf757f5a0
MD5 SHA1 SHA512

Submit Download

nscFB83.tmp

Path C:\Users\Admin\AppData\Local\Temp\nscFB83.tmp
Size 30B
SHA256 1886befe7455fcda2daf5715f2b768e012a1d6debe288fa5feb4e523fd4f52d4
MD5 1ef630a300aa83be06f631ae4caafaaa
SHA1 d6f50f255a7a2c875b9a2e72f9fe0e3555d7d0a9
SHA512 05b243bd5bfcc6445cf75d3ce9786761a1bf88850d6232e988956f1f5975fb5de1e801fdb8ccb8c8baa340080c4a51817943eba07d3ca07c1d8bf8d7f66f160e
MD5 SHA1 SHA512

Submit Download

nscFB83.tmp

Path C:\Users\Admin\AppData\Local\Temp\nscFB83.tmp
Size 57B
SHA256 80eb66b392cf670bb4afede5a57488fc9e9166f9a8c492f290d150c834e1e6aa
MD5 0b66f70a086797e3c9d810089c376755
SHA1 aa9a99dcae2c50513922413999a555bc89af69b1
SHA512 83461cf2e760708cbdf9a083594c63f55e4b2d90166d5ba3b3f06e1e35e3b9be2c6d1a97da5b7ac04a444d4c6ab04da11adf8a0a1a268597c1e6f3022c8445f1
TLSH
T11F90025635814654F982C4711B657008E59D302600C544031A4D44485D05067CA0A5D4
MD5 SHA1 SHA512 TLSH

Submit Download

nsdFE47.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsdFE47.tmp
Size 27B
SHA256 2660dc03224de6b184ffcb97188e0b67d7153d5cafc3e06b7add32e8f6ae17cb
MD5 96e800d57a121450b8c625f8dd78a040
SHA1 6658c74061e12b49dff78a75efc8be7a169087c4
SHA512 1e3fa019730429258de5658136f217d93124bd8e03597089079402f3db9cad620d29ad020ad5d8047d58df2b10ab56b2452191cf132144bd81cf911671636e03
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsmFC5E.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsnFCFD.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsnFCFD.tmp
Size 6B
SHA256 6923dd1bc0460082c5d55a831908c24a282860b7f1cd6c2b79cf1bc8857c639c
MD5 50484c19f1afdaf3841a0d821ed393d2
SHA1 c65a0fb7e74ffd2c9fc3a0f9aacb0f6a24b0a68b
SHA512 d51a20d67571fe70bcd6c36e1382a3c342f42671c710090b75fcfc2405ce24488e03a7131eefe4751d0bd3aeaad816605ad10c8e3258d72fcf379e32416cbf3b
MD5 SHA1 SHA512

Submit Download

nsnFCFD.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsnFCFD.tmp
Size 9B
SHA256 ae789a65914ed002efb82dad89e5a4d4b9ec8e7faae30d0ed6e3c0d20f7d3858
MD5 2b3884fe02299c565e1c37ee7ef99293
SHA1 d8e2ef2a52083f6df210109fea53860ea227af9c
SHA512 aeb9374a52d0ad99336bfd4ec7bb7c5437b827845b8784d9c21f7d96a931693604689f6adc3ca25fad132a0ad6123013211ff550f427fa86e4f26c122ac6a0fe
MD5 SHA1 SHA512

Submit Download

nsnFCFD.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsnFCFD.tmp
Size 10B
SHA256 a7de06c22e4e67908840ec3f00ab8fe9e04ae94fb16a74136002afbaf607ff92
MD5 9a53fc1d7126c5e7c81bb5c15b15537b
SHA1 e2d13e0fa37de4c98f30c728210d6afafbb2b000
SHA512 b0bffbb8072dbdcfc68f0e632f727c08fe3ef936b2ef332c08486553ff2cef7b0bcdb400e421a117e977bb0fac17ce4706a8097e32d558a918433646b6d5f1a1
MD5 SHA1 SHA512

Submit Download

nsnFCFD.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsnFCFD.tmp
Size 60B
SHA256 841dc08b8cb7a68b74c3a782e1043be391dc5aee2ada726e64e19ffe2ab479b1
MD5 e7f2ec4de6f343fa7fbb2c9bba53b704
SHA1 fd73c75719b746fbb3770607cc8a78e5dcd97820
SHA512 75640bdab603a44b1649ab527468dd59172264f2e9e24ec947024ef8c4e8899aceaad24d00c176503b0b0867c22a4354e427da637bed3ddc0d71cecc18f34b80
TLSH
T177A00219458149E427478427FE31A124575968544C7A14125BAD6941B91358E820315A
MD5 SHA1 SHA512 TLSH

Submit Download

nsnFD9A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsnFD9A.tmp
Size 32B
SHA256 9b8062221a0d073ebaaa68dc362326896bc0d45a60b92c8deb3b817303ee2a55
MD5 2d479cc532f3ff469fcdc85909bd602c
SHA1 3d8db518048d3a2cf9206441641ad274ab451d35
SHA512 99c774af0e38bf25bbd263fc16970458848a9602427b51ca1ceb4d642a04664a6f43e721c8e9816d4849eb8cba40a8ded2f1748f835664786aaac865884ef3b2
MD5 SHA1 SHA512

Submit Download

nsnFD9A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsnFD9A.tmp
Size 56B
SHA256 777234c4c53220dc6d5e20fc1c7a152a5532c2e76438e29a5dbc7e7d2f0ad24d
MD5 21fa547ac13d587464a19867b98dd5c0
SHA1 dbe7397631a67bd7c0602ae7008fe811b0cc45d6
SHA512 4b630e3ac26d762591914d84df51b1b0da727d65558714fd8ba66e363afacd0adfb927b604bdc685a22070fcbf9caffdb68eedd26da7861d9b5d46dce25dbdfd
TLSH
T12590022419456978E247E8E6EC114945954956146C1B10014766549472428C78456546
MD5 SHA1 SHA512 TLSH

Submit Download

nsnFD9A.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsnFD9A.tmp
Size 42B
SHA256 2476aef9aded7d4c946deed767cb1289d8bae0c0cdd4ea8e97ff6f67760f8635
MD5 71e7ecf99b7f1f205e8bda2225d67657
SHA1 9ea596f7cb0bbed3bf356da1905b016969d8d5b9
SHA512 526380a110221b53cc7aaf83b57c516ef91d9893d4da1f4a79bcfb180b698192321dbfc34755026d682c7518c2597931bb397e0faae86d230953d595a8ed93cd
MD5 SHA1 SHA512

Submit Download

nssFC7F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nssFC7F.tmp
Size 8B
SHA256 1c329924865741e0222d3ead23072cfbed14f96e2b0432573068eb0640513101
MD5 c3cb69218b85c3260387fb582cb518dd
SHA1 961c892ded09a4cbb5392097bb845ccba65902ad
SHA512 2402fffeb89c531db742bf6f5466eee8fe13edf97b8ecfc2cace3522806b322924d1ca81dda25e59b4047b8f40ad11ae9216e0a0d5c7fc6beef4368eb9551422
MD5 SHA1 SHA512

Submit Download

nssFC7F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nssFC7F.tmp
Size 12B
SHA256 9c2c033694acd2ee629918b688ee91e0032e6d2fa5cbb6b39a13e50024e73e01
MD5 f55b9d6e5f20db4066c68219d6cc7244
SHA1 b3a70fc3ea2da60d58274d9466a88a1e57926356
SHA512 35bde19664ead683e639f42ed8447eab5bac8a1ac873efde467439e0631e3ece634b90e25140e62f46189df57f5c8fb6af44a8062ca9750514f8571d5860f2e1
MD5 SHA1 SHA512

Submit Download

nssFC7F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nssFC7F.tmp
Size 16B
SHA256 0d4b1effa5ab30d5f6d9e6b1bd6de429d4a25075dbdf2f28d67beab72f6bff0e
MD5 299751a30a50b5a6b62371c27fc4e478
SHA1 2a016fdba9876a7aade76bff3c4780633d5e6ef4
SHA512 6917664885b34990ded6171ea01bfb2e1ff67e38455bee9d75e80d3905db7e7199679ae3761e290062e679ccf2555804b0ec1a59a5fd74c5069857c3326264e5
MD5 SHA1 SHA512

Submit Download

nssFC7F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nssFC7F.tmp
Size 32B
SHA256 05ec837bf0f57ead1b3fae5bec24f103831be6946eda1fe4cec3700ae019b117
MD5 749841d5d4f33aa61da2072ca8c75d85
SHA1 ed779369af6004bb662353a1a1688de21c9d5964
SHA512 07884f39b2b1646dbad182d39167df36cb86fd3751b5c125b84ab3b3594dd0f6884d73f7f65d099e2874a0a73f8a76d7610b3ab30e174945a70073176e07b886
MD5 SHA1 SHA512

Submit Download

nssFC7F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nssFC7F.tmp
Size 27B
SHA256 1bf567e8c29ff4bd0866da8a312c38c4c2ffabf6916a87fa7bc7bbba2b42db36
MD5 0ec6691c283ddc7f19331d3c214c58d2
SHA1 5b30d6927130c7a3ce16dfa809238c6f6fc61e6f
SHA512 8ea2702bd97781067bdfe3008e9aa1da303db56b8d03bd076823308d299e369b2d989708ea707b5c4a51b96d3d07001e7f0c3d9767f08933fde0f9feba28493f
MD5 SHA1 SHA512

Submit Download

memory/3736-563-0x00000000771FF000-0x0000000077200000-memory.dmp

Download

memory/3736-564-0x00000000771BD000-0x00000000771BE000-memory.dmp

Download

memory/3736-565-0x0000000077285000-0x0000000077286000-memory.dmp

Download

memory/3736-577-0x0000000000480000-0x0000000001766000-memory.dmp

Download

memory/3736-578-0x0000000077285000-0x0000000077286000-memory.dmp

Download

memory/5660-562-0x0000000073E85000-0x0000000073E86000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads