231d18ad99decd85d7e77cb547d0540adccb03c599714d75dc3ca417ef374e5d

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
coreldraw_graphics_suite_202x_oem-patch.exe
Size 67KB
Sample260810-ve3slshd82
SHA256 231d18ad99decd85d7e77cb547d0540adccb03c599714d75dc3ca417ef374e5d
MD5 2a102a0f19c76575722b78bd75bb2c26
SHA1 f914707600a5aa7c301e419249a4bbfd0fcad31f
SHA512 7d5b184eb92a934e22ca8551694e873d57af615450fb687b59450437eec10a9e82e1987682aea200c07e8151842403e5029194f4051b2a4428b8eabf3e5ca9e6
SSDEEP 1536:6O0JFqDBtzJIxB3l+OVjfW3Lf2u5cavNo4sxAKF:28DbaxB0EjwLX5calwJ
TLSH
T19363F12BC94B6D51CAB61D3D41E790A6547C29E7B142A31FFBC085886FF142AE8D13B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1968	coreldraw_graphics_suite_202x_oem-patch.exe
1968	coreldraw_graphics_suite_202x_oem-patch.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	coreldraw_graphics_suite_202x_oem-patch.exe

C:\Users\Admin\AppData\Local\Temp\coreldraw_graphics_suite_202x_oem-patch.exe
"C:\Users\Admin\AppData\Local\Temp\coreldraw_graphics_suite_202x_oem-patch.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

55800DBCA0A3F329BB00B68A0CE49879.dll

Path C:\Users\Admin\AppData\Local\Temp\55800DBCA0A3F329BB00B68A0CE49879.dll
Size 4KB
SHA256 4a89aa25771a7ce4a283013fc5a322dd6a40257de701fd527dc60a7e58421e47
MD5 495c3d8f0a697be5508040d1cce0aa94
SHA1 2181d494a5ac736ef655b33b474c7a55fad70625
SHA512 80b1ea680ba115be68ad892abe8be2f36a0d66775ca6fbe77247445132168c4270bee87c715528bd102c86f4f3277736eed42cafcaa8e647d510de3e5fa74fa5
SSDEEP 48:SHQlg9djkVrDbrzaCOku77PUfa7D6EyNbt2:nwjMrTruPf72Ewbs
TLSH
T13E91333377B8D912D1AA0FB755F78BD5B674F6B00391520D67C0062F2D602076CA5B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dup2patcher.dll

Path C:\Users\Admin\AppData\Local\Temp\dup2patcher.dll
Size 61KB
SHA256 ad217264cb9696f6a613847651c0e09b870656495ee348e72c76c19c2169ae61
MD5 98727de361904fa0962d2aca68494441
SHA1 ea0eb777b8aef78b1d6e26d1fe7d75d43483caf3
SHA512 cf3e4cc8be091b9a659204183d1c20b51e215755b73bf8ed92172051f915a8d7fcd3e379b0640f9d28eb81d8193e4d78155f86af284efd110b1317c1de56bb4f
SSDEEP 1536:S/Tilc2ldltF9j6RW8H3/1lxC+oU0ODb/xI:ATYc2ldltF9jWW8H3/1lxC+oU0ODb/
TLSH
T1B953F8546D97827DC3A057352CE59E6086786F31E760E0179F7C1E2C2F21A53EA2BE32
MD5 SHA1 SHA512 SSDEEP TLSH