667bf54e9d20c53f0ebb7f5c94876804b4378f61cd910845ad5b97dbe3adfa20

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
667bf54e9d20c53f0ebb7f5c94876804b4378f61cd910845ad5b97dbe3adfa20.exe
Size 1.6MB
Sample260807-mn7h6ack2x
SHA256 667bf54e9d20c53f0ebb7f5c94876804b4378f61cd910845ad5b97dbe3adfa20
MD5 3cf0b7d76a15e6415602365222223e10
SHA1 fcfdd833ff5508540ca3b0ec977b8c4bf059a762
SHA512 f94d7c43dab7c9f1a5a5eb42ce4da90cfdbd8dcd2428997a907ea33394c3ea53b867d246b907f8bf73993ff0cfd8d727d6d4f41335ccfaab049969501e0c3889
SSDEEP 49152:leBlJpsuyIoU/ux9HPRryE5yrZoDnskYQdR:leBlJpsLiW3BVaunsMR
TLSH
T1F885017119AFDAD3F741C4309CEE39510A6E78293490A6ED7978BA2E58DA370141C3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1808	Un_A.exe

Loads dropped DLL 7 IoCs

pid	Process
1808	Un_A.exe
1808	Un_A.exe
1808	Un_A.exe
1808	Un_A.exe
1808	Un_A.exe
1808	Un_A.exe
1808	Un_A.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	667bf54e9d20c53f0ebb7f5c94876804b4378f61cd910845ad5b97dbe3adfa20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Un_A.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 1808	2624	667bf54e9d20c53f0ebb7f5c94876804b4378f61cd910845ad5b97dbe3adfa20.exe	89

C:\Users\Admin\AppData\Local\Temp\667bf54e9d20c53f0ebb7f5c94876804b4378f61cd910845ad5b97dbe3adfa20.exe
"C:\Users\Admin\AppData\Local\Temp\667bf54e9d20c53f0ebb7f5c94876804b4378f61cd910845ad5b97dbe3adfa20.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nss61BF.tmp\System.dll
Size 12KB
SHA256 00f7604d4f36a728c7759f4d9cf3e30c9728c503557aac49bbcd55cfc3e4fcb4
MD5 e38d8ff9f749ee1b141a122fec7280e0
SHA1 fbc8e410ef716fdb36977e5c16d3373a6100189a
SHA512 2b1dccf42d435445331291db94f869c4e8f6dcdfe4371969e76ee275d4e845e1d2e947c216f80484a7dd4b8e85158298e6ec7ed9add6d4259c07fdf87c316a8f
SSDEEP 192:lGvqZRJOts/+FEi3wIYbhTe+j++RSlpUZCai:XRYtsxi3gdTXtOpyC
TLSH
T10E423C074B70C9F2F1510A3D0CA2BE276BBCBEA812E584735FD7188579542DB7569383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsNiuniuSkin.dll

Path C:\Users\Admin\AppData\Local\Temp\nss61BF.tmp\nsNiuniuSkin.dll
Size 982KB
SHA256 548b7113ae115d936a790760a46c3a50ddbae6ddaf163e6510007d1c280a5488
MD5 149cfa10b1d18a65e2d0407d1a5930ea
SHA1 ba678e9857b405c434eacdbf1f322c75bd568db4
SHA512 5b977dfb3ee61b5e65ceaf0f31b871b95129896862b17c9eb9690dd2d560830d2b16cb95ab729cf80a0c069a04052d43a0f9288756caf0958353346c05dc2c6b
SSDEEP 24576:cW/O23c8rH6o28TSlATaNS5O3TuWpwx52+A7kZ/QZAKaaSzUafmUwIcl3PVV01S:cW/O23c8LAlATaNS5O3THq52+A7kZ/Qv
TLSH
T157257C11DA41A13AFDFB04F64D7F56BE9429AA31032450CBA3D49EAE4B359E17E31323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\nss61BF.tmp\skin.zip
Size 881KB
SHA256 b053b276b08822fb9eeefa123fcb78b7028e7ba97a855e7c83113213e73271ad
MD5 472d1a7448d511a264385b2d4164387c
SHA1 ab4178c7935b3d0d54c2538ca8014b76bef4ad99
SHA512 68dd5edb4d0d26ae38ffaa77363785f0c09661e30092006fa9ff4b91a5406db770b6107dbb1fb31f87b11c40eedb410148a252ae323b5391bc6f1b85cd8586e5
SSDEEP 24576:8/ezViCna1zcvNWaF1dTQQwasFkcOmEWyf:82zVdnMzMMU1Bnscf
TLSH
T1A21523F1B71D2B7CEA4A13BCA1D97001BD5A522D166439A21BA030BA9CD77F6470339F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Un_A.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
Size 1.6MB
SHA256 667bf54e9d20c53f0ebb7f5c94876804b4378f61cd910845ad5b97dbe3adfa20
MD5 3cf0b7d76a15e6415602365222223e10
SHA1 fcfdd833ff5508540ca3b0ec977b8c4bf059a762
SHA512 f94d7c43dab7c9f1a5a5eb42ce4da90cfdbd8dcd2428997a907ea33394c3ea53b867d246b907f8bf73993ff0cfd8d727d6d4f41335ccfaab049969501e0c3889
SSDEEP 49152:leBlJpsuyIoU/ux9HPRryE5yrZoDnskYQdR:leBlJpsLiW3BVaunsMR
TLSH
T1F885017119AFDAD3F741C4309CEE39510A6E78293490A6ED7978BA2E58DA370141C3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads