f74d03062c36c4214bf1fd32fc5a2da8d33ece75ab76c1eea6b20799f84bdcdb

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 09:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Todesks_12.8.1_x64.exe
Size 11.9MB
Sample260805-k761macr91
SHA256 f74d03062c36c4214bf1fd32fc5a2da8d33ece75ab76c1eea6b20799f84bdcdb
MD5 d1db9263aedd7bf2c97d32f9cc65c9fc
SHA1 9b28331e9dc09b3d2c6237c5ab3b60a01958e9c6
SHA512 f831a5f2c72cc679f62464967f94606556e5c77a258212f209369edacd33cec2d1ded4a2a0b93c07b9deda09504f503da330f0fe63d0bad36a66090e6447b34f
SSDEEP 196608:3Qe3tBhlvEAYzs50/mj61MCNHB2xKtAkD6e1Z7LH3CEIpqYcUJAAEIPooG8mMJUt:3XLh53ix+IMSB2xKtF31tL1MncS/dPof
TLSH
T16EC6330824F9CEC6E9A7D03F3C6F4AEB2DE0D2523187F16BDD1AA16E64593C0461D366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2072	Todesks_12.8.1_x64.exe
2072	Todesks_12.8.1_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Todesks_12.8.1_x64.exe

C:\Users\Admin\AppData\Local\Temp\Todesks_12.8.1_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Todesks_12.8.1_x64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd8AD3.tmp\InstallOptions.dll
Size 15KB
SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
MD5 ece25721125d55aa26cdfe019c871476
SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
SSDEEP 384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
TLSH
T1E1624D1137C558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsd8AD3.tmp\ioSpecial.ini
Size 1KB
SHA256 c325c645e27ec988c86a8000bfd65f33dd099af1a4777fe2b8e591cd90b4849a
MD5 e8d78e0760769b9126b13072663f16c4
SHA1 17a98f1d375fa29fbc16a2008e3ba00154bb6a74
SHA512 d6de237aa7c43fa5ddac8178b5a22e1c88d214b735db4addde13b3990c75daf3c301ce6248e35b96aa10cbadbf1883af18a77976912a6a850d91e1bacbfeea35
TLSH
T15C21E7072AEA5A19F26AF70CEBF0403953397845945DDA5E81C10A0F44FAA81D527BEF
MD5 SHA1 SHA512 TLSH