cd6a6e376ff87c85857e9ca0a934c6dbed8923aa327264a06f023714c9dec3f3

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cd6a6e376ff87c85857e9ca0a934c6dbed8923aa327264a06f023714c9dec3f3.exe
Size 1.7MB
Sample260728-ezz98aeh83
SHA256 cd6a6e376ff87c85857e9ca0a934c6dbed8923aa327264a06f023714c9dec3f3
MD5 b3c9247c8e01376b0221553ec9736d03
SHA1 74257c400653ffaf3b45fbf5233696d8da64bd2b
SHA512 34cd6763be9314c051d87c5261def09103bb6780b7abbe9cc3b36c8682b2786d4006d64a5521d4cd3e6f05cff5c1e61ac9f690fe9847362a32aad7441f0b94cb
SSDEEP 49152:nm/glmRRtyBN9uMupBYy08YQaSi4b8AD6h:nGAm4BjuCYaSLbV6h
TLSH
T13F853341BAB1DDA9FAE64438A073E36DE19247707DD1D30E07205185386FBB225BFA63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1188	cd6a6e376ff87c85857e9ca0a934c6dbed8923aa327264a06f023714c9dec3f3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd6a6e376ff87c85857e9ca0a934c6dbed8923aa327264a06f023714c9dec3f3.exe

C:\Users\Admin\AppData\Local\Temp\cd6a6e376ff87c85857e9ca0a934c6dbed8923aa327264a06f023714c9dec3f3.exe
"C:\Users\Admin\AppData\Local\Temp\cd6a6e376ff87c85857e9ca0a934c6dbed8923aa327264a06f023714c9dec3f3.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl845A.tmp\nsDialogs.dll
Size 9KB
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
TLSH
T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download