81f30c1bb33c7881cd4e6a0dd835b7f186d928407dc56e50d1959324e2396772

Analysis

geolocation tags

eueuropefrfrance
max time kernel
901s
max time network
461s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 06:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
amm.exe
Size 136.6MB
Sample260801-hdt3vsfb73
SHA256 81f30c1bb33c7881cd4e6a0dd835b7f186d928407dc56e50d1959324e2396772
MD5 f939bf76e4a913ac43e7ad15139a8e04
SHA1 7729d085b560ff0931826c39cf8dbc22f42f23a4
SHA512 0a383d266e690ceb2abd575427522790f7e17f624ed16ff448d19750a9aba55f6e44d1982d2bb3026e4bdb02c5d5894da84cb474b5c58f643457096e51f0f6d7
SSDEEP 3145728:rydOwC2/IEZt/FRYgLptukO2daOWd5v4mCuRasT:mA2/rh/ojOuR5
TLSH
T116683350D66AF69CE58D80B2DE72BA73B806D62C91520D0E6A2F7510F071A2734EFD4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
5740	amm.exe
5740	amm.exe
5740	amm.exe
5740	amm.exe
5740	amm.exe
5740	amm.exe
5740	amm.exe
5740	amm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amm.exe

C:\Users\Admin\AppData\Local\Temp\amm.exe
"C:\Users\Admin\AppData\Local\Temp\amm.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1472

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aero.dll

Path C:\Users\Admin\AppData\Local\Temp\nszC0D7.tmp\Aero.dll
Size 17KB
SHA256 9bbbdd180dac3cf4ce36cbc12bd862cdd00880d87027395f92ede5476d1f0dd0
MD5 5155e506b908b41e113bbd7c10d4082f
SHA1 0e0d2d3a6c76c08d434ac7359eb9927f82ac6065
SHA512 a43f04fffb05458a307054caaa45ba81c383b0265d7af798996806ecb07b72bb5350df7bf4d6d7b21a30c82f4308343845bb32cc8e0ad0cd36e352499ca7ccb1
SSDEEP 384:z01Th+YSzSPHnK/QDG8hic1OyxOPnkfXeI74n:8T59dOyxOPnIXdo
TLSH
T107823B0A0F648173D7E2067AB4ADBB576A3E9D219B641CC343FB45846C2C7D23E7861B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrandingURL.dll

Path C:\Users\Admin\AppData\Local\Temp\nszC0D7.tmp\BrandingURL.dll
Size 4KB
SHA256 bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
MD5 71c46b663baa92ad941388d082af97e7
SHA1 5a9fcce065366a526d75cc5ded9aade7cadd6421
SHA512 5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
TLSH
T13B81203B37F219F3C2314BBB18836ADB7A6E80200365405B547B1A6BB442CA7CD29743
MD5 SHA1 SHA512 TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nszC0D7.tmp\LangDLL.dll
Size 9KB
SHA256 ccb76172c2565356a838d7867a51e021478fed4d83eb41fe1dbb703f8efa28f9
MD5 d6d8addfea0ee1bba9b841e3bec0b5cd
SHA1 a36ba78140600a7b1a502bea25c50c76666f5d3f
SHA512 3f85eb0baca0794adbc7460af8b3b21d5b0b9d250eeba842f8524ea9736877aaabd5f51035bee8836ad46bf1d01e416119ca7f296bae32bacdad44622c1715ec
SSDEEP 192:J1V5tvxNSmwVEIvR4gqVwtVku+pdhhvEFjO4RR:zV5f0mwVEgAVeI7xeye
TLSH
T12F123A2357590A73EB404F7B5099F2835972DED07BD9440B533B02C92D14BF32EAEA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nszC0D7.tmp\System.dll
Size 15KB
SHA256 e457505b7648838185fd971e19daf6fd626824d7935a2701342df7099315e62c
MD5 f4e3fa5c852d2bdc41756e58124b21d3
SHA1 a49ec55e50d25efa45ce93366fb64c4fbb1d8261
SHA512 3ccbd9bf27d7927fdf34aecf672d78cb85d00b2b53da631f60683e46d85eda73021d2ae2c7c3d533424b1f8d174093d2186e1bd821fe02312fc142048b75d243
SSDEEP 192:TDKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF7bVwtVku+pdhhuZHpgiU6/:TViJrtFRdbmXK8+PCwfVeI70HpI+
TLSH
T1F4627E8987A481F3E7808E7D05DDB9331B78A6506AE54E539F3314816E087D33DBD22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nszC0D7.tmp\nsDialogs.dll
Size 9KB
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads