dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 20:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe
Size 1.1MB
Sample260810-ze8fbasyev
SHA256 dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980
MD5 828855c9ca1b300541e581ab41cc40d6
SHA1 909ee047f4df7affaee0e911efc49306c1652b41
SHA512 c462e3f17045b0642e2752971b21a281f4574b98c220a50d87d06da4334d145881218c5b15484efdb8454625076ad3153accf37e69ded8ada30631acd1156291
SSDEEP 24576:K+/0ARK/TWLGCtES37Za5DE5rmYGOqzSF:d8P/T1wESFKQr/G5m
TLSH
T12635F1D4E768C890F01A44B9E323D9785E74AC119DACE9AB95F07C2774FBA83641DC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2280	dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe
2280	dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	drive.google.com
11	drive.google.com
17	drive.google.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\upcoils.ini	dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2280	dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe
1716	dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2280	dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 1144	2280	dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe	89
PID 2280 wrote to memory of 1716	2280	dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe	90
PID 2280 wrote to memory of 1716	2280	dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe	90
PID 1716 wrote to memory of 3412	1716	dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe	91

C:\Users\Admin\AppData\Local\Temp\dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe
"C:\Users\Admin\AppData\Local\Temp\dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe
  "C:\Users\Admin\AppData\Local\Temp\dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe"
  2⤵
  PID:1144
- C:\Users\Admin\AppData\Local\Temp\dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe
  "C:\Users\Admin\AppData\Local\Temp\dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Users\Admin\AppData\Local\Temp\dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe
    "C:\Users\Admin\AppData\Local\Temp\dc698522859bcc7c5337e5d5b316924e39472c5ff3ef58b3118b1835279ff980.exe"
    3⤵
    PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr52EA.tmp\System.dll
Size 12KB
SHA256 a44ca08afb3f6bafd76aa35c259f3d599fe34f6f49ea5118626c1c1a540b0f03
MD5 81e268e27dbbcadbf116b5a9402195ab
SHA1 bd2b701b2e5e279786e179bceee2dc132a2afc37
SHA512 784115c69df4a6f180efb4d48cf5c6e8c2393b8ce9aa664f192abf5a260984880c668dd0f93564126d2fc718130570c4f6224d1373d73bcb8343f04f6ede25de
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/d93:97pJp48F2exrg5F/d
TLSH
T10C424B1583618EF3F5961E3C00667E2F2B79BE3416F104A39FE34481AD9A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1716-46-0x000000007795F000-0x0000000077960000-memory.dmp

Download

memory/1716-47-0x000000007791D000-0x000000007791E000-memory.dmp

Download

memory/1716-48-0x00000000779E5000-0x00000000779E6000-memory.dmp

Download

memory/1716-49-0x0000000000490000-0x0000000001776000-memory.dmp

Download

memory/1716-50-0x00000000779E5000-0x00000000779E6000-memory.dmp

Download

memory/2280-45-0x00000000745E5000-0x00000000745E6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads