131ca5833313b3adf4342b45548445e4023a3f53d6929c9339578c191924b935

Analysis

max time kernel
152s
max time network
200s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Plugins/directwavevst_install.exe
Size 11.8MB
Sample260809-m79gvsdr4w
SHA256 131ca5833313b3adf4342b45548445e4023a3f53d6929c9339578c191924b935
MD5 e08d7a16680a7254ae4e82dae6acec9f
SHA1 df58e774fc28b7524c12e23562ec5f3b2f74e6c2
SHA512 fa5ba63e5122ef50f6c644f03096f10c854ff1ea00ba5715b5a94ea9f3227a4679cc7f2ffa7a669ff234487eb5d08445f9b7aba9df82823f579ddc5c8428cdaa
SSDEEP 196608:Je3rjIoq10fPLJDck5kKa8dp6arGUy12c5KiwjHWaBik18l3N0CszLkXSTx7Zy:zlahg8bJq1cGrwbWaJ18xN3soeg
TLSH
T19EC633A391610A8DFF2502B3F3907B058773F6BFD85DAC5652B27EB608D614227CA21D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
2604	directwavevst_install.exe
2604	directwavevst_install.exe
2604	directwavevst_install.exe
2604	directwavevst_install.exe
2604	directwavevst_install.exe
2604	directwavevst_install.exe
2604	directwavevst_install.exe
2604	directwavevst_install.exe
2604	directwavevst_install.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	directwavevst_install.exe

C:\Users\Admin\AppData\Local\Temp\Plugins\directwavevst_install.exe
"C:\Users\Admin\AppData\Local\Temp\Plugins\directwavevst_install.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ILInstallUtil.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx204D.tmp\ILInstallUtil.dll
Size 343KB
SHA256 32b674a0de4577544e138b7675110a6f09a99dd576a8b847af6a8e5976002325
MD5 e396b4dba8c838b9eec93e8ef428e73e
SHA1 f4c17acabd53262ce1576e1a59a4f8dc264ef077
SHA512 cab82519fe54f37d33e5254ba6abe3cf1533580535a27faf5f8c9caf832269564067e9355a99e33d8cc218c19f20fa17e439aa49ea21058435f933fe246bac1d
SSDEEP 6144:9S9ZlvuAVyPczPlWo+AiL9RujmwyJYi8q8V1NjQ:98ZlvvVqcz9WpuyJgfV1ZQ
TLSH
T142743B23EF80C43BD0618A3949E7A363593FBE60F9D578165EE4CD4F4E65281283E6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx204D.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioA.ini

Path C:\Users\Admin\AppData\Local\Temp\nsx204D.tmp\ioA.ini
Size 637B
SHA256 737b5ac756096e7c9c6bcc337f237c6585fe2c36941f3954b214964d46fc50cb
MD5 5a413c5f39d0df8fc712e806e813f5d9
SHA1 85e48631f7b2d0977c88a7ef714f017fdda7fa32
SHA512 6d0be94ae496efa56b45e8dab5569b0591ba15423c51b5321cea8f15f895c845d8427670959f0c119b68d7dc053dd632575e78a5d840ece4b35e696c0322892f
TLSH
T126F0A48CD40282F9D434948328AB3AD533C029249F4F68E9F3B56587AB9DCD78CAC186
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsx204D.tmp\ioSpecial.ini
Size 688B
SHA256 645f84c0e1e2f09839c1979d981573caed8002a4b8c8208c65a93238b49c1cce
MD5 25341f2eeef22e30d63339ec7c2a0282
SHA1 aab2516f622c31a3848149b6e4b23331f2246e90
SHA512 d01bb47271356a1020b292798e47b3671336253e731b160a2757a15c2d207b9ce06b4f35c03eea00de09fa3dbc9d9dcaabf00e73d394097b8d9606e8412151c8
TLSH
T1B7019E89946FE369442010D664F9379247D02C3C47213DF6F0529D86A78CDD78AE9ED3
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsx204D.tmp\ioSpecial.ini
Size 727B
SHA256 07c906f7b615449a62f057556168a3e10f2b22026a5742a3f35b377ca75bb847
MD5 96719fb4336b3264a67cbec21dbc4dbc
SHA1 7077690996566be9c8625ffe9321a1144e4c98fd
SHA512 d07b9b6678edffe8353e170d063d3664c4a2e61f38a2a0aed82befb4764352fcb9e04f6f1292ff0e1967bc4fcd365fcc51b195b5024f765f65f74a094a18eb85
TLSH
T12A01C088846FD3A9442010D660F9379257D02C2C47663DF6F0528C86A34CDD7CAED9D3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2604-85-0x0000000006090000-0x00000000060F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads