fc4623b113a1f603c0d9ad5f83130bd6de1c62b973be9892305132389c8588de

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinPcap_4_1_3.exe
Size 893KB
Sample260730-w3hm1sem2s
SHA256 fc4623b113a1f603c0d9ad5f83130bd6de1c62b973be9892305132389c8588de
MD5 a11a2f0cfe6d0b4c50945989db6360cd
SHA1 e2516fcd1573e70334c8f50bee5241cdfdf48a00
SHA512 2652d84eb91ca7957b4fb3ff77313e5dae978960492669242df4f246296f1bedaa48c0d33ffb286b2859a1b86ef5460060b551edca597b4ec60ee08676877c70
SSDEEP 24576:UBOldyR6ORWsaM2QROxa6jsqUENfJjNK/CG6niqiL:2KzqWsayROxa6QDENuaG+ifL
TLSH
T17F15231507A47D77FF274270906FEA60AFFEC2294390362733A464EA2D53AD62B1417B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4324	WinPcap_4_1_3.exe
4324	WinPcap_4_1_3.exe
4324	WinPcap_4_1_3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinPcap_4_1_3.exe

C:\Users\Admin\AppData\Local\Temp\WinPcap_4_1_3.exe
"C:\Users\Admin\AppData\Local\Temp\WinPcap_4_1_3.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nszF3E2.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nszF3E2.tmp\UserInfo.dll
Size 4KB
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
TLSH
T1E181857B92E50DF3D0A447BB00D71CE70226DC701769411E89472A8924E572BFE2EB06
MD5 SHA1 SHA512 TLSH

Submit Download

bootOptions.ini

Path C:\Users\Admin\AppData\Local\Temp\nszF3E2.tmp\bootOptions.ini
Size 362B
SHA256 ee7d7dc529a9aa79851b1b067de44c7ea9273a145c2711cc44bf889f9a651bc5
MD5 0d257ba9cdf5ba4905f66cb35627d986
SHA1 0e394e2fbbcda281347b09c9a0f5efd850784030
SHA512 810305dd3c8f527753e7c807f83238d29366b95e3b72803059b88c1216045e043b7ae10986f513387229f0826ed5205f7d15f2a88a1c6064c0acc8b533892c49
TLSH
T115E068812002C7368820A184993FABC2BBB030387F9408B0F0986C82EA55AD253BCAC9
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nszF3E2.tmp\ioSpecial.ini
Size 578B
SHA256 db4d8cebe3d1ef4d8bb58494dc696b9118ede7e9599ec61b92608732a125d06a
MD5 c16b3a01da68f1a6610a9748d6960d7d
SHA1 8490f62e1d6c0415b35cbe26cf1633278234ee85
SHA512 310926380e49aedc9274d9676fe226e424083f88b001388503fd4bd6eef021734af569c3c872180737be0c4663f8b5b41d6257fe70a8efe4bbd519eb2bca8c2e
TLSH
T18AF046CCC42B93361411954264BE3B8767902C30475A7AFAF4315C42934EED696DAA82
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nszF3E2.tmp\ioSpecial.ini
Size 618B
SHA256 55f756943527981f46e73ee585f24b130e8a4310fa05ccaaf79a17cbc310ceb1
MD5 783b301416ceacfeba24d4c8f01580eb
SHA1 6ac151d16a5b182eff2ac2aac7524a2404329636
SHA512 1478df9447485c431749445b4ce42ef6476a3f6674181b46b8c9244ff68e97ea05214e98608e433b70590fefdce3a4c992b7d469ad0e59b188aea5b613e92827
TLSH
T12AF044CCC42A93361415558164BD3B8677902C20865A7AFAF43158429349ECA96DA681
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads