7c44f508b9d19429061f914dcadbb41bdaafbba3c8b8bb6c2d02e6f41ff55960

Analysis

max time kernel
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wallpaper Engine 2.8_Andros Flow/dotnet-sdk-9.0.315-win-x64.exe
Size 220.4MB
Sample260809-x4mtsscm7v
SHA256 7c44f508b9d19429061f914dcadbb41bdaafbba3c8b8bb6c2d02e6f41ff55960
MD5 0f6f0ff34c8d093eaaebea7883a336dd
SHA1 5b2851e7c1317309db854041d28585d254cd7ce2
SHA512 c8d7ceb195df850d3c0d24c506e6641ae37940df0b2b551db4f1100e388ef11c868e014183016f1e90606afc528310f89f80f32a1c8d73f2b8c1311a79ec9d60
SSDEEP 3145728:OupdSUfw5VzM+6beXB3oN01WQ9CviKQpZvds+bUfLrDGKSZ+67xCrnVa3JR3:n7lfGpkbeXB3D1WQ9TKEWgUfSQrVs3
TLSH
T1BCB83333E1A4CF7CF6982A73C56DA71C641876520A51581AD3ECECFA02932CF51B7E92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
3824	dotnet-sdk-9.0.315-win-x64.exe

Loads dropped DLL 1 IoCs

pid	Process
3824	dotnet-sdk-9.0.315-win-x64.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-sdk-9.0.315-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-sdk-9.0.315-win-x64.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5708 wrote to memory of 3824	5708	dotnet-sdk-9.0.315-win-x64.exe	88

C:\Users\Admin\AppData\Local\Temp\Wallpaper Engine 2.8_Andros Flow\dotnet-sdk-9.0.315-win-x64.exe
"C:\Users\Admin\AppData\Local\Temp\Wallpaper Engine 2.8_Andros Flow\dotnet-sdk-9.0.315-win-x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Windows\Temp\{3BB84337-0CBB-4AEE-AFBF-4F65E501A6D7}\.cr\dotnet-sdk-9.0.315-win-x64.exe
  "C:\Windows\Temp\{3BB84337-0CBB-4AEE-AFBF-4F65E501A6D7}\.cr\dotnet-sdk-9.0.315-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Wallpaper Engine 2.8_Andros Flow\dotnet-sdk-9.0.315-win-x64.exe" -burn.filehandle.attached=764 -burn.filehandle.self=696
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bg.png

Path C:\Windows\Temp\{299CFE5E-76C6-4DFF-BBA3-6460CBB36554}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{299CFE5E-76C6-4DFF-BBA3-6460CBB36554}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet-sdk-9.0.315-win-x64.exe

Path C:\Windows\Temp\{3BB84337-0CBB-4AEE-AFBF-4F65E501A6D7}\.cr\dotnet-sdk-9.0.315-win-x64.exe
Size 611KB
SHA256 d98797f4a2e0275972db94206ced74ca27712118653b983f5e2b44f59a1fda7f
MD5 ef35386ac263af47ad51b270e27daa06
SHA1 0d22572437a3e3b147698fbbfb6f13e3dda34819
SHA512 54ab631147ce56c4faa46052cc7fa915fb3d03a51cbf1357a43ab2cf20be5670140d47f8ae11caddddbb9bc32e7f06bc62e2981481229f8619c624db9cf8e931
SSDEEP 12288:SmEsd9PZfePv3xl7ft7V+6uC+zd5qLlIvqwtslO0zfppz87V:Sm39PZfePv3r7fm6t+jqpQqaslG
TLSH
T1C4D47C32A5614032E7F10673B928D6303E3CE328275488AAE7D4AD1D7EB84D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads