00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe
Size 888KB
Sample260801-gp2fmsen8v
SHA256 00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567
MD5 00d1386ab7bc8a72d075813480cfb082
SHA1 35eb4ad99745ab2bdbac0553f71cdaa0f584d827
SHA512 fe23ed95154026594c49b7f365d7a530c599152ef170e2d5d2cc00aa25796e766f2277378d4f08309bd0b4a16f239be4520cf0fe137d5ae1c735ec4e3a735a6f
SSDEEP 24576:LPMMMMMMMMMMMMMuKMMMMMMMMMMMhMMG8xXT6dVUkbiF1Y58m+yCaJWk9yA0g:LPMMMMMMMMMMMMMuKMMMMMMMMMMMhMMq
TLSH
T1A11523173F90C967CCA61AB442BED9474BF23D0591E6668F37EABB053C5A1B3910F602
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4648	00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe
4648	00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4648	00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe
2452	00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Skolelgerne252\dominerendes.zip	00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe
File opened for modification	C:\Program Files (x86)\Common Files\Nonreliance112.ini	00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4648	00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3760	4648	00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe	92
PID 4648 wrote to memory of 2452	4648	00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe	93
PID 4648 wrote to memory of 2452	4648	00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe	93
PID 2452 wrote to memory of 3040	2452	00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe	95

C:\Users\Admin\AppData\Local\Temp\00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe
"C:\Users\Admin\AppData\Local\Temp\00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe
  "C:\Users\Admin\AppData\Local\Temp\00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe"
  2⤵
  PID:3760
- C:\Users\Admin\AppData\Local\Temp\00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe
  "C:\Users\Admin\AppData\Local\Temp\00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Users\Admin\AppData\Local\Temp\00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe
    "C:\Users\Admin\AppData\Local\Temp\00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567.exe"
    3⤵
    PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl3B7E.tmp\System.dll
Size 11KB
SHA256 d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57
MD5 4ca4fd3fbefa2f6e87e6e9ee87d1c0b3
SHA1 7cdbeb5ff2b14b86af04e075d0ca651183ea5df4
SHA512 cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8
SSDEEP 192:EPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4W:j7VpNo8gmOyRsVc4
TLSH
T198325C5503504AF3E996863C00263B7FAF796A2095F14D53CFA39480FE2E5C9AD78352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2452-24-0x0000000077848000-0x0000000077849000-memory.dmp

Download

memory/2452-25-0x00000000778E9000-0x00000000778EA000-memory.dmp

Download

memory/2452-26-0x0000000077865000-0x0000000077866000-memory.dmp

Download

memory/2452-27-0x0000000000450000-0x00000000016A4000-memory.dmp

Download

memory/2452-28-0x00000000778E9000-0x00000000778EA000-memory.dmp

Download

memory/4648-23-0x00000000744A4000-0x00000000744A5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads