7403be7427bbe1936a40dded082829b6e217fc4f5990fee5cba501f0ae055afa

Analysis

max time kernel
599s
max time network
462s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 20:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EqualizerAPO-x64-1.4.2.exe
Size 11.4MB
Sample260805-zpmxcsfr3t
SHA256 7403be7427bbe1936a40dded082829b6e217fc4f5990fee5cba501f0ae055afa
MD5 410aab9749ae4673b950bc29a4eb226f
SHA1 f599c3a16d27864d330529a012fc23a37abdd06d
SHA512 85c31ae500384e168e15c8f1089cb9570d7e72df7f8b2d22e76de171399550cfd775f1bfb539654e287340cf2b3638bb442c3f804c5aaa81b44272e44f05e244
SSDEEP 196608:ZeChCgKhSkiU/msfpFBNGGF2gYntzw+wHX2N5OzauxUeBd5LUOMbDfzS:ZLQSkiU/msf12gYntzMda+B
TLSH
T1ECC633288DD0D0BFC49C8EB3EC31A4D8FB572678B64DB66270110D7D897DAC63D69682
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1068	EqualizerAPO-x64-1.4.2.exe
1068	EqualizerAPO-x64-1.4.2.exe
1068	EqualizerAPO-x64-1.4.2.exe
1068	EqualizerAPO-x64-1.4.2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EqualizerAPO-x64-1.4.2.exe

C:\Users\Admin\AppData\Local\Temp\EqualizerAPO-x64-1.4.2.exe
"C:\Users\Admin\AppData\Local\Temp\EqualizerAPO-x64-1.4.2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NSISpcre.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiAC6.tmp\NSISpcre.dll
Size 164KB
SHA256 43041f8540dccbc33268bfbef53037d17170b037f6393e77c21429f303ae828f
MD5 bfe060c22b44914e05d3f5367de6c9fe
SHA1 24c72b0b57b0066a5e8b235104a0502400e44b9a
SHA512 ad3a23edd8d62b198e4a2ccf03f6d607dee41fa23fd6f9dfabdc5ee424b5e22a6e00b8a28e50fe177829a2cc25ce05484423e97c682036fc5146e2adf560bc44
SSDEEP 3072:5YFyk+vtvpoYYPkoYMtXTP5V+4Km//sbJVlseEOb+Y+UT:KFyznYntXL5XKCk9MeEm7
TLSH
T1D6F38C41F887C4F2CA4B433A587D63165B38F7440BB68BCB7F845E7DBA916822D6124B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiAC6.tmp\StartMenu.dll
Size 7KB
SHA256 a6919f5f3b53a9c8c015413babe7a9872491a2583e49bb3c261e60785c3c3534
MD5 26836307758e048d1ce0afe754d6a972
SHA1 23a8f45cf5e2ad78add3c4dd3b3cf15fffced2cc
SHA512 aaf7cfbb9c6951b65bd377db401617812f1d47960a01ae99164183c642fbd8f1ce08720bc92d26b642da5433b80720dfcd96280a162decf678139966be132746
SSDEEP 96:IgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1tk3hhEl7y:IgiqVPgK8K9eIdE9B/t8hg7
TLSH
T15AF108BAF3C005B3CB8F86702853BF074B56E630535561A39B5341CA75D18A3ED38321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiAC6.tmp\System.dll
Size 11KB
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
TLSH
T116326D5503504AF3E996863C00263B7FAF796A2095F14D53CFA394C0FE2E5C9AD38352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiAC6.tmp\nsDialogs.dll
Size 9KB
SHA256 8780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
MD5 1c8b2b40c642e8b5a5b3ff102796fb37
SHA1 3245f55afac50f775eb53fd6d14abb7fe523393d
SHA512 4ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57
SSDEEP 96:o2DlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4T8qndYv0PLE:o2p34z/x3sREskpx4dO0PLE
TLSH
T13012F8135A4454B3C9E6223A31AA2F2EDB3C9324D0627D02C7779E5A2BB42167D3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads