35ddc702c20a7d50601716ce27f382a17b5091e27bfcfa543a06c97a93fc21d5

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hl7-2-dcm-2.1.32-win64.exe
Size 3.1MB
Sample260731-plagraae87
SHA256 35ddc702c20a7d50601716ce27f382a17b5091e27bfcfa543a06c97a93fc21d5
MD5 2b302a0a18bd405a5e56f4e8c1e9c88c
SHA1 bd0264d7b3e2d817aa1500c668df4c6a09ddcaf6
SHA512 a52f5113c74392cb27b6b65a926c14dc2ff6fa755427c29521826392dbad59e6818600ef02cb875e5ccc0128c2ebc92ddd634515e3f78b0014cf9453b9b8c178
SSDEEP 49152:6tb5d665xey366hmMWbvPbO47BKC8pG/MHgtkUPCZEzPNYYe9ALSeB31X2dKx:6t9dz5T3HWbvPK4w3pG/d1J29AJ0dA
TLSH
T1B1E53347BF308956C666E8733DBFCB77DF70B691194344EB3A0709A5A923889DD0A087
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1424	hl7-2-dcm-2.1.32-win64.exe
1424	hl7-2-dcm-2.1.32-win64.exe
1424	hl7-2-dcm-2.1.32-win64.exe
1424	hl7-2-dcm-2.1.32-win64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hl7-2-dcm-2.1.32-win64.exe

C:\Users\Admin\AppData\Local\Temp\hl7-2-dcm-2.1.32-win64.exe
"C:\Users\Admin\AppData\Local\Temp\hl7-2-dcm-2.1.32-win64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu7575.tmp\InstallOptions.dll
Size 14KB
SHA256 aaacc7ef5cb2baf2338ac8e8479227e0a6336a6509119543680efa1dcdbae6a6
MD5 5d425526856cbdb7b14c75df417b6ef3
SHA1 46407f40cac772bca3804dc80fd489f87668a9e3
SHA512 b806bf9622040d120b407ae83d20ae935c9ff210332062f8fa3eccecba2a41bd041cf9523d500f9ce11b73076b97a884907cc06722531c2fe9b8d96ec16124fb
SSDEEP 192:74n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjHK72dwF7dBOne:sn3T5KdHCMRD/R1cOnrjH+BO
TLSH
T186622A55738488F3DBE2003E785237079B995565B492AED2CA275FCA687B08D7EB2303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu7575.tmp\StartMenu.dll
Size 7KB
SHA256 27fb85eede9b98f4fb6cd9bd22f1f268e13d3bb365a4bb8da744090d032c76e4
MD5 e439ea88b4453578adcfe9026cd287fd
SHA1 414ce13b7d4f2b1c4d51a71a037ec2822fa63e61
SHA512 f8d1023eb3c665ecd10805bb95e1b29491b3653bd7178bdd39daffaf83564626e8679864056333ebfbf631f414195771de7824e669a07bacb0a04eee8d74b062
SSDEEP 96:8giqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1ts3hhEl7y:8giqVPgK8K9eIdE9B/t0hg7
TLSH
T166F107BAF3C005B3CB8F86702813BF074B56A630535561A79A5341CA75D18A3ED38322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu7575.tmp\UserInfo.dll
Size 4KB
SHA256 a912514823df595ba3a048099d3b89e925a4d41742afc67e772060952892f312
MD5 e167f9a565781a30c03ff10370033319
SHA1 1858758b076946073de375c6eb1bec9867aa3689
SHA512 96d8f5ac8e2c0961ba71075de52d12515e7a058cddf3fa1ec14e77545b0b5f4e29324a13e2eb287a447f1d24dc9f09e0a70b0a25401b0ef8d90e6e4a96ce6c61
TLSH
T1AF81717BA3E41EF3C048437B409718E76761CE701396011F59470A8A28E0E7BEDAEF49
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsu7575.tmp\ioSpecial.ini
Size 669B
SHA256 d9a0af497c483241e3cdc0151e709012f0bd2b58ef71bdc69ada629a8a01db26
MD5 434d3c1d5f4545f759e979963a44fe4f
SHA1 ffad2a3bb185a74f621b47861ebe88e2b77a391f
SHA512 bab8f708f561252f8fefa6b8c0063386467e2ef21adc4790f5b1eb62ffc702caa8fb3f038be596285a0aa1c9f3b33f18120d884a6383b0cb216f17f48504a6f9
TLSH
T120019989851FE32904205096B4F937E257E02C3C4B223CF2F0528C8697CDDD38AE9ED2
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsu7575.tmp\ioSpecial.ini
Size 708B
SHA256 3d28fc30bd387b24c381318aef9c7d06cff919bb19ebaa982ff03deddd428e52
MD5 38e2d1d924244e5d07b1c0cacc342410
SHA1 52da8f5cd305855aa0efbd0ac147b1184beea0e9
SHA512 1e6c6723b9b2adc35e6704c646d3f14526a86b52d4bf198e6024fff11e4e1d0a2d5d8b93a8afb184e61bc4a44f5caf8342797b99cf92305b58d4774984d44855
TLSH
T117017089491FD3A9442050D664F937D257E12C2C4B553CF2F0528C8697CDDD38AED9D6
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads