d2cb2b1b89dfeb565e0ae3ed1cba7d00186eadf3820f330cf03d0bb4231ac61a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UpdaterSetup.exe
Size 29.2MB
Sample260805-w11e2stcnd
SHA256 d2cb2b1b89dfeb565e0ae3ed1cba7d00186eadf3820f330cf03d0bb4231ac61a
MD5 6f095eab04a3f52fd97161ea4b8c4db7
SHA1 de9cbf1006e690b4eb2987d0a45a84b6bf3c700b
SHA512 7fec84c6358492beb809b9e907625157fe33d8758c348baa90f637c0251bd9934973b5a12ddf4cda73757ffeed0d596fc427e6a7571ac7a05712168049b30910
SSDEEP 786432:U0ay2tMT8mWDACjI421oykeL0Z40kB0kPel8Z6yiMtx:U0ctYHXCE4qLuZxkiK
TLSH
T10E673326F318C716C84354328F9BB65947947E3AED5588B5EB443B1EEE7A083823C64F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
5040	UpdaterSetup.exe
5040	UpdaterSetup.exe
5040	UpdaterSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdaterSetup.exe

C:\Users\Admin\AppData\Local\Temp\UpdaterSetup.exe
"C:\Users\Admin\AppData\Local\Temp\UpdaterSetup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl7AAA.tmp\InstallOptions.dll
Size 15KB
SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
MD5 ece25721125d55aa26cdfe019c871476
SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
SSDEEP 384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
TLSH
T1E1624D1137C558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl7AAA.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsl7AAA.tmp\ioSpecial.ini
Size 1KB
SHA256 b609287b9d261cf6ee1e95c00fde940358dee09ae47c3a4f7fe9ad7fdd309c17
MD5 a292062e4d4fec6c825462ae6988d52c
SHA1 5f29e0cf73649e7601b25f8dfc7ae5c53b1e20e0
SHA512 20ca5bc09900e4257121cc630f2e2bfacf3c73dc6a2ff2acabff1b00c14f5c267ce99a423515579c656ccf09b35e7168c4ab6947665941d0771c15b9a63cfd9e
TLSH
T1E7314E5F1DBF5520A6B6A5E5E9B280355739F845041CCD2FB2E1250E88EDD0049D3BAF
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads