Overview

overview

7

Static

static

3

dd89930157...34.exe

windows10-2004-x64

7

dd89930157...34.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/07/2026, 10:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dd89930157d36e8f5b8a0038cfe1a25ad94123dc6a7d580d67b097d7f452d134.exe
  • Size 3.4MB
  • Sample260729-mebecstvdv
  • SHA256 dd89930157d36e8f5b8a0038cfe1a25ad94123dc6a7d580d67b097d7f452d134
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstaller

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 27 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 2 IoCs
    installer
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd89930157d36e8f5b8a0038cfe1a25ad94123dc6a7d580d67b097d7f452d134.exe
    "C:\Users\Admin\AppData\Local\Temp\dd89930157d36e8f5b8a0038cfe1a25ad94123dc6a7d580d67b097d7f452d134.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4960
    • C:\Windows\Sandboxie-Classic-x64-v5.72.6 (1).exe
      "C:\Windows\Sandboxie-Classic-x64-v5.72.6 (1).exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Users\Admin\AppData\Local\Temp\nsaF574.tmp\KmdUtil.exe
        "C:\Users\Admin\AppData\Local\Temp\nsaF574.tmp\KmdUtil.exe" /lang=1033 scandll
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:832
      • C:\Users\Admin\AppData\Local\Temp\nsaF574.tmp\KmdUtil.exe
        "C:\Users\Admin\AppData\Local\Temp\nsaF574.tmp\KmdUtil.exe" /lang=1033 stop SbieSvc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2580
      • C:\Users\Admin\AppData\Local\Temp\nsaF574.tmp\KmdUtil.exe
        "C:\Users\Admin\AppData\Local\Temp\nsaF574.tmp\KmdUtil.exe" /lang=1033 stop SbieDrv
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4188
      • C:\Program Files\Sandboxie\UpdUtil.exe
        "C:\Program Files\Sandboxie\UpdUtil.exe" install sandboxie /step:scan /scope:meta /version:5.72.6
        3⤵
        • Executes dropped EXE
        PID:5712

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Start.exe
        • Path C:\Program Files\Sandboxie\Start.exe
        • Size 353KB
        • SHA256 18dd9a7f8e68c51518019ffefe3a23a394d9c64ec55023edc694bb3512d0d61f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UpdUtil.exe
        • Path C:\Program Files\Sandboxie\UpdUtil.exe
        • Size 180KB
        • SHA256 f06e2c142b166d5ffa868f64196b4411693349020ed320634d640991acc74ffa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InstallOptions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsaF574.tmp\InstallOptions.dll
        • Size 14KB
        • SHA256 254c5ccbce59ad882f7f51d0bf760cabde8c88c5af84e13cc8ad77ba0361055c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KmdUtil.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nsaF574.tmp\KmdUtil.exe
        • Size 210KB
        • SHA256 a979fa423b5f6d74aeb2c81ecdce8d7c18283bff9d5db40c80e7868394685b47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LangDLL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsaF574.tmp\LangDLL.dll
        • Size 5KB
        • SHA256 09477d605677bea48019b896f068ce6c2e89004e5c5f0a86c0276db30c6515a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SbieDll.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsaF574.tmp\SbieDll.dll
        • Size 981KB
        • SHA256 ddb11a48cd2a8d3c835c4f41e1f6a7a9793cdbff688a74e0650d820530eb73c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsaF574.tmp\System.dll
        • Size 10KB
        • SHA256 4ca5bf1beb4b802914c4d3e2f37861f6ba5ecf969cfeadf5855edf58f647a721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Warning.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nsaF574.tmp\Warning.ini
        • Size 885B
        • SHA256 daa5346092e7eb8ac8212994873b06e071ed316dcfedd43399b61751c8cdc816
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Warning.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nsaF574.tmp\Warning.ini
        • Size 950B
        • SHA256 e40d865882519336b41f5b3395c2b103bdc9f28cd6b2bf92519680060a2a7845
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Sandboxie-Classic-x64-v5.72.6 (1).exe
        • Path C:\Windows\Sandboxie-Classic-x64-v5.72.6 (1).exe
        • Size 3.0MB
        • SHA256 f97b02c21849ad5a239ba5626e8493fbca0618c130cd786555f847c4875d53bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download