1858db792ec577593512e28f0b9d3fb924af16c2888c9bc774ec8906780c9fd4

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 05:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d87e8486cedfaa53c741d39a6a8fed55.exe
Size 220KB
Sample260806-ge5ejsvaka
SHA256 1858db792ec577593512e28f0b9d3fb924af16c2888c9bc774ec8906780c9fd4
MD5 d87e8486cedfaa53c741d39a6a8fed55
SHA1 14fd8704c5b2592c6fd7920a6e25a57990d0b75c
SHA512 fe060886b3de4a2ddfb7b5c67d2a2255e2422b5ac94202211fd04620a8f651cde26b0dffa740cf2d8bf3db079578f23b796ff552cabd4090084bb6e427b23af4
SSDEEP 3072:4DxaVzwmg4CSW8JSuPzNa7Ax1vCBkoInsIoIdGKNON1tV2vt:GMm4CChdK2l
TLSH
T1BB24EA77E2FC568BC4A1AB3D4660C2F007D31D54ECA88F07E9A2B5CD5638DC478A694B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2716	Un_A.exe

Executes dropped EXE 1 IoCs

pid	Process
2716	Un_A.exe

Loads dropped DLL 2 IoCs

pid	Process
2716	Un_A.exe
2716	Un_A.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d87e8486cedfaa53c741d39a6a8fed55.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Un_A.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2716	Un_A.exe
2716	Un_A.exe
2716	Un_A.exe
2716	Un_A.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 2716	3156	d87e8486cedfaa53c741d39a6a8fed55.exe	89

C:\Users\Admin\AppData\Local\Temp\d87e8486cedfaa53c741d39a6a8fed55.exe
"C:\Users\Admin\AppData\Local\Temp\d87e8486cedfaa53c741d39a6a8fed55.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa3669.tmp\System.dll
Size 12KB
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
TLSH
T1F6427D1193B089F2F590593805A67F2A6FBEAC5C27E44963CFE345853D702DFA47A243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa3669.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Un_A.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
Size 220KB
SHA256 1858db792ec577593512e28f0b9d3fb924af16c2888c9bc774ec8906780c9fd4
MD5 d87e8486cedfaa53c741d39a6a8fed55
SHA1 14fd8704c5b2592c6fd7920a6e25a57990d0b75c
SHA512 fe060886b3de4a2ddfb7b5c67d2a2255e2422b5ac94202211fd04620a8f651cde26b0dffa740cf2d8bf3db079578f23b796ff552cabd4090084bb6e427b23af4
SSDEEP 3072:4DxaVzwmg4CSW8JSuPzNa7Ax1vCBkoInsIoIdGKNON1tV2vt:GMm4CChdK2l
TLSH
T1BB24EA77E2FC568BC4A1AB3D4660C2F007D31D54ECA88F07E9A2B5CD5638DC478A694B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download