131ca5833313b3adf4342b45548445e4023a3f53d6929c9339578c191924b935

Analysis

max time kernel
149s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Plugins/directwavevst_install.exe
Size 11.8MB
Sample260809-m79gvsdr4w
SHA256 131ca5833313b3adf4342b45548445e4023a3f53d6929c9339578c191924b935
MD5 e08d7a16680a7254ae4e82dae6acec9f
SHA1 df58e774fc28b7524c12e23562ec5f3b2f74e6c2
SHA512 fa5ba63e5122ef50f6c644f03096f10c854ff1ea00ba5715b5a94ea9f3227a4679cc7f2ffa7a669ff234487eb5d08445f9b7aba9df82823f579ddc5c8428cdaa
SSDEEP 196608:Je3rjIoq10fPLJDck5kKa8dp6arGUy12c5KiwjHWaBik18l3N0CszLkXSTx7Zy:zlahg8bJq1cGrwbWaJ18xN3soeg
TLSH
T19EC633A391610A8DFF2502B3F3907B058773F6BFD85DAC5652B27EB608D614227CA21D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
2392	directwavevst_install.exe
2392	directwavevst_install.exe
2392	directwavevst_install.exe
2392	directwavevst_install.exe
2392	directwavevst_install.exe
2392	directwavevst_install.exe
2392	directwavevst_install.exe
2392	directwavevst_install.exe
2392	directwavevst_install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	directwavevst_install.exe

C:\Users\Admin\AppData\Local\Temp\Plugins\directwavevst_install.exe
"C:\Users\Admin\AppData\Local\Temp\Plugins\directwavevst_install.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ILInstallUtil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq9042.tmp\ILInstallUtil.dll
Size 343KB
SHA256 32b674a0de4577544e138b7675110a6f09a99dd576a8b847af6a8e5976002325
MD5 e396b4dba8c838b9eec93e8ef428e73e
SHA1 f4c17acabd53262ce1576e1a59a4f8dc264ef077
SHA512 cab82519fe54f37d33e5254ba6abe3cf1533580535a27faf5f8c9caf832269564067e9355a99e33d8cc218c19f20fa17e439aa49ea21058435f933fe246bac1d
SSDEEP 6144:9S9ZlvuAVyPczPlWo+AiL9RujmwyJYi8q8V1NjQ:98ZlvvVqcz9WpuyJgfV1ZQ
TLSH
T142743B23EF80C43BD0618A3949E7A363593FBE60F9D578165EE4CD4F4E65281283E6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsq9042.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioA.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq9042.tmp\ioA.ini
Size 559B
SHA256 046418edc6a67c11484266006dd928ccf276dfe7cc91f54859cce920cad5854d
MD5 1cf3b118183f06734ca6e51944bfb394
SHA1 385e748f71e2e2dad3ae9f04cd16addcf3eb093a
SHA512 6d64a29831887980dfc050a980db545ff24e6fbc7282144a676a5db1945c7f436e7f36e80133ebee38c6bd48c647cacc3efc3b94eb75cfeb5e47f32517a5e718
TLSH
T1FBF0908CE40292B9D430945328AB6AD633C029241E4769A8F3B62587AB9DCE34DEC182
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsq9042.tmp\ioSpecial.ini
Size 688B
SHA256 6d817c4b5bfcb36db7930929a8f96fee9f16971be0db2a1f68dac9d231d83788
MD5 427e375c787ad8828ed3a3204e36749e
SHA1 9ff1a40fde6c8146aae588bfe915ad47c0e4e328
SHA512 b6cf6daa52e1b765241b11ab69899001edf87a5028995fb7b1a8cdd37a48f4b463e3d8c7f0fda8f834f3ec8e55768e81876e70d2a36ad02bafa08812d54c2b45
TLSH
T170019E88946FA369442010D664FA379257D02C3C47213CF6F0539D86A38CDD78AEAED3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2392-85-0x00000000054F0000-0x0000000005550000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads