fad33c468c8ef7a67ab53907a0d2c5ddadc4ef50fd35507b1e2f80be841c14eb

Analysis

max time kernel
0s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fad33c468c8ef7a67ab53907a0d2c5ddadc4ef50fd35507b1e2f80be841c14eb.exe
Size 1.3MB
Sample260728-e2wd2seh96
SHA256 fad33c468c8ef7a67ab53907a0d2c5ddadc4ef50fd35507b1e2f80be841c14eb
MD5 e735ff57791595fb14dc92fedc28829b
SHA1 e67afe8f31d0f5b79af325bdba2977443d0571fb
SHA512 e4fed1b81f32ab2fcba4b3498d52e0dd6312c566e64525d51175a1c41e9776fc7d6fc1add3496dd43713f7842180b61aa78886413249c1c93fb595cc84bee1f5
SSDEEP 24576:Dn8rh09WzsBi4d/WdKo/Nl+iee5/MV48GxMgGNQDO9VKqOdkJ464PtdQPjfaC8iB:7OmRfo/itVpGqgGN7fLOm41d4j9bB
TLSH
T11865DF5EE726BCE4FD2A53F9353658233F42951364FD286D90A2962E9C3420350BBDCB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4444	fad33c468c8ef7a67ab53907a0d2c5ddadc4ef50fd35507b1e2f80be841c14eb.exe
4444	fad33c468c8ef7a67ab53907a0d2c5ddadc4ef50fd35507b1e2f80be841c14eb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fad33c468c8ef7a67ab53907a0d2c5ddadc4ef50fd35507b1e2f80be841c14eb.exe

C:\Users\Admin\AppData\Local\Temp\fad33c468c8ef7a67ab53907a0d2c5ddadc4ef50fd35507b1e2f80be841c14eb.exe
"C:\Users\Admin\AppData\Local\Temp\fad33c468c8ef7a67ab53907a0d2c5ddadc4ef50fd35507b1e2f80be841c14eb.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4444
- C:\Program Files\hydrophilous\nationwide.exe
  "C:\Program Files\hydrophilous\nationwide.exe" ""
  2⤵
  PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Microsoft.WindowsAppRuntime.Bootstrap.dll

Path C:\Program Files\hydrophilous\Microsoft.WindowsAppRuntime.Bootstrap.dll
Size 244KB
SHA256 53705c18c5cf15b4c1c1c8b2ec4f702c66fc67d2ec674c20203ee3ca72feff73
MD5 4231254d69d4c2fceeb6040e61e0053e
SHA1 8cc2f5b279498825549e92c3cea4df23ad790fc4
SHA512 ba96a283405fa441ed2fa70c497c3d5e3868a637e5b600b087125a4588139202f81fd18c6acbf7abb9af013ba9ffbbc0bca44d4643253b1192d3b4d701f09029
SSDEEP 3072:JVZysoFqML4Dw15lgI1nemp3xazwhiB4zgt56cTPbWNtKHtR0GzUKgGrJ25yuI:JisoeDjwefB4zyoGYZI
TLSH
T1DC346B4BB3A2947CE15AC038931BD1B7BB72B8C606217DBF12E496343E56D512F2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fluorhydric.zth

Path C:\Program Files\hydrophilous\fluorhydric.zth
Size 923KB
SHA256 95825d9700ef4eb877826d032f376252e70d3358ef41e22a4645438f3b9b31db
MD5 7287eb96d10de3fc7407664c3434cc0d
SHA1 fe315d57fb5cb3bdac0d8400ba35613e8f47f93a
SHA512 c8bdb4c94500a4863b6d67bf88361d243b54c1e2bdbb4551fd6a6033c72d7d6b9a7c7a2bee5e45317097886c31dcfaa3af69d5c27b672ae3a25af6e2967ac0df
SSDEEP 24576:0EoyZ3NW7zxq4ZBjbTBlZLapZsh9hvaUtY+K55:0EPiztHj1FhW8255
TLSH
T1AA15330FAEC4915B6917A1365F3DE43B0FE24CBD0356EE9CD2CDAB70B91643095EA089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nationwide.exe

Path C:\Program Files\hydrophilous\nationwide.exe
Size 186KB
SHA256 27eceee997c135653f992d1bac7e013d219108b8fc08078911afa4b5bce5d2ea
MD5 0a8819d828c93251c4ad2bbb1a42f8a7
SHA1 627578ffef6dc402c55fab1380d0054bca47860b
SHA512 f074bd60fc7cf801659a3bbf1488536762883d63e4721d5a8e6d7c230c2513adb69d095eb30ea7da8558d23f6efa66a0ed520346d91e81a7b48be39c370fd6bd
SSDEEP 3072:RLEs+CGsZUhmLXostDi7z9GJ7jmUsrgfSu1Pb:GsVFUELYIMYZpP1D
TLSH
T118145B4772A820F9E0678279C8914A05FB72B8711B60ABDF0364837B5F337D19D7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nst4DCF.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nst4DCF.tmp\utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads