41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe
Size 8.1MB
Sample260813-mltvaaab95
SHA256 41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742
MD5 674e77f1144cb4fe7b5dfdf285df2c0b
SHA1 b5c2c85ad234157be49c41444daaa6902224571f
SHA512 2776bef0b61b1939a4511925272dcd5e1c02725479ca3b2de7eb5fccea714d8efc6cb8b7f11d2659d92c90ededb91e695e85574175e9add972525e3b4e638a77
SSDEEP 196608:/Z70yAyMG7GVukKsLJbfeB/D96e69AGIQhqZ/A0:/KO7gukKiJb2BL9D62GNhIF
TLSH
T1B68633BFE7444279D94101BC7DFEC605B6FEB86922B4090541DB133F9EE1AB809B28B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
804	41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe
804	41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe
804	41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Writtt\Writtt\Writtt.exe	41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe
File created	C:\Program Files\Writtt\Writtt\uninstall.exe	41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe

C:\Users\Admin\AppData\Local\Temp\41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe
"C:\Users\Admin\AppData\Local\Temp\41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Writtt.exe

Path C:\Program Files\Writtt\Writtt\Writtt.exe
Size 16.3MB
SHA256 6b113a59bf495cf9ef44a950993a58f8dabbf70a533c10b814f768db71d0f21d
MD5 82df134a2dfb16441c0273bfade860ff
SHA1 edc7eae4e066b72d58d26837e088147e07cdc8d5
SHA512 8b699c7671c7de104a1d752fd814b01c774912235e53741852de1151be409e0f33764d25b47a76a21c57a0a327a2c0deea105e6eeddbb9f447ad70f663857d8e
SSDEEP 196608:bTzERo/MZg7ZShYnS3n8uFqyyxqwJM/oDoYOtcWFv57OoJPQAwA8CIYBxdJz3Ftm:bo/g7ZSynYLeJ
TLSH
T128076B47E86511F5C0AAC935C9A6D152BB307C888F2427D77B60FB642F72BD0AEB9710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3D44.tmp\InstallOptions.dll
Size 15KB
SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
MD5 cfc7c53e282b0a7c527e4ed091f17fcd
SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
TLSH
T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3D44.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsx3D44.tmp\ioSpecial.ini
Size 1KB
SHA256 7138ad2f0397e701bee3a77195aeb52b67d4992efdff51b5497292ba1d92812b
MD5 572e52c82cf57c7acf9b84ec426d4025
SHA1 d945f6e8b77dd0993ab8d5b2162c6523dc632ac9
SHA512 6754447979a202b0a8e82215df9ee28477695441e53d71fb34528c9303faec67ed37cdd702493756af02926a87ab6fed607e427d891cd23514673300b86f5a61
TLSH
T1BA219F437BFC1204F2FABB14FFB541758B3A7C16A839D60D81C1090E09E5B808963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsx3D44.tmp\ioSpecial.ini
Size 1KB
SHA256 08ba19c927bbef3b9f4997e1b8781cbf1a3d276fc54d1a25c7c4e19e6ac91b4f
MD5 3b23e5e74473e8097fdd49184eb358bd
SHA1 1b4277e706addf7acc10af31785423dac600cd7b
SHA512 5a70b996946dce27c31850de1a89d27a5aaeeca09b8ec3cc2013b33d95aa2732e6d8d0244d322e92709f5f0813d211e0ed8d1a91e4cdab875d64005bc103921f
TLSH
T160118F037EFD4014E2BAF618EFF5807547397855582DD50E81C10A0F48E6A808923BEF
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads