c526e479370ca81067d366765db5936b086cd0b085e5f94fafd01d0041626210

Analysis

max time kernel
30s
max time network
33s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Zentimo.xStorage.Manager-3.4.1.1304.exe
Size 3.7MB
Sample260813-2wtplahk21
SHA256 c526e479370ca81067d366765db5936b086cd0b085e5f94fafd01d0041626210
MD5 f67ff709d0482d0e13e37dcbf505a97e
SHA1 76d8d59caa483a7c5af27b805a5f26b75ff99142
SHA512 3cc1f01e5dd53ee1804abc3a13b9a055c44e9d797d2611fbf0d5769d518c295735c04749e5de57e5594abb4a545cc7ccf15a7da91f8aea5d64645e643af966ad
SSDEEP 98304:HTlvoa9Jm2EGAEwJb1d69kLSwhkEaiXLwUCJUcGKhtHdTQt:HHSCgo9chkwX8UCGehu
TLSH
T134063395735E2A97CE8FC4720493E516DB3BA9C85E783B2BC7403F4F961781A0A2C05E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
4900	Zentimo.xStorage.Manager-3.4.1.1304.exe
4900	Zentimo.xStorage.Manager-3.4.1.1304.exe
4900	Zentimo.xStorage.Manager-3.4.1.1304.exe
4900	Zentimo.xStorage.Manager-3.4.1.1304.exe
4900	Zentimo.xStorage.Manager-3.4.1.1304.exe
4900	Zentimo.xStorage.Manager-3.4.1.1304.exe
4900	Zentimo.xStorage.Manager-3.4.1.1304.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zentimo.xStorage.Manager-3.4.1.1304.exe

C:\Users\Admin\AppData\Local\Temp\Zentimo.xStorage.Manager-3.4.1.1304.exe
"C:\Users\Admin\AppData\Local\Temp\Zentimo.xStorage.Manager-3.4.1.1304.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aero.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3178.tmp\Aero.dll
Size 17KB
SHA256 9bbbdd180dac3cf4ce36cbc12bd862cdd00880d87027395f92ede5476d1f0dd0
MD5 5155e506b908b41e113bbd7c10d4082f
SHA1 0e0d2d3a6c76c08d434ac7359eb9927f82ac6065
SHA512 a43f04fffb05458a307054caaa45ba81c383b0265d7af798996806ecb07b72bb5350df7bf4d6d7b21a30c82f4308343845bb32cc8e0ad0cd36e352499ca7ccb1
SSDEEP 384:z01Th+YSzSPHnK/QDG8hic1OyxOPnkfXeI74n:8T59dOyxOPnIXdo
TLSH
T107823B0A0F648173D7E2067AB4ADBB576A3E9D219B641CC343FB45846C2C7D23E7861B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrandingURL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3178.tmp\BrandingURL.dll
Size 4KB
SHA256 bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
MD5 71c46b663baa92ad941388d082af97e7
SHA1 5a9fcce065366a526d75cc5ded9aade7cadd6421
SHA512 5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
TLSH
T13B81203B37F219F3C2314BBB18836ADB7A6E80200365405B547B1A6BB442CA7CD29743
MD5 SHA1 SHA512 TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3178.tmp\LangDLL.dll
Size 9KB
SHA256 ccb76172c2565356a838d7867a51e021478fed4d83eb41fe1dbb703f8efa28f9
MD5 d6d8addfea0ee1bba9b841e3bec0b5cd
SHA1 a36ba78140600a7b1a502bea25c50c76666f5d3f
SHA512 3f85eb0baca0794adbc7460af8b3b21d5b0b9d250eeba842f8524ea9736877aaabd5f51035bee8836ad46bf1d01e416119ca7f296bae32bacdad44622c1715ec
SSDEEP 192:J1V5tvxNSmwVEIvR4gqVwtVku+pdhhvEFjO4RR:zV5f0mwVEgAVeI7xeye
TLSH
T12F123A2357590A73EB404F7B5099F2835972DED07BD9440B533B02C92D14BF32EAEA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3178.tmp\System.dll
Size 15KB
SHA256 e457505b7648838185fd971e19daf6fd626824d7935a2701342df7099315e62c
MD5 f4e3fa5c852d2bdc41756e58124b21d3
SHA1 a49ec55e50d25efa45ce93366fb64c4fbb1d8261
SHA512 3ccbd9bf27d7927fdf34aecf672d78cb85d00b2b53da631f60683e46d85eda73021d2ae2c7c3d533424b1f8d174093d2186e1bd821fe02312fc142048b75d243
SSDEEP 192:TDKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF7bVwtVku+pdhhuZHpgiU6/:TViJrtFRdbmXK8+PCwfVeI70HpI+
TLSH
T1F4627E8987A481F3E7808E7D05DDB9331B78A6506AE54E539F3314816E087D33DBD22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi3178.tmp\nsDialogs.dll
Size 9KB
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads