41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe
Size 8.1MB
Sample260813-mltvaaab95
SHA256 41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742
MD5 674e77f1144cb4fe7b5dfdf285df2c0b
SHA1 b5c2c85ad234157be49c41444daaa6902224571f
SHA512 2776bef0b61b1939a4511925272dcd5e1c02725479ca3b2de7eb5fccea714d8efc6cb8b7f11d2659d92c90ededb91e695e85574175e9add972525e3b4e638a77
SSDEEP 196608:/Z70yAyMG7GVukKsLJbfeB/D96e69AGIQhqZ/A0:/KO7gukKiJb2BL9D62GNhIF
TLSH
T1B68633BFE7444279D94101BC7DFEC605B6FEB86922B4090541DB133F9EE1AB809B28B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1708	41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe
1708	41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe
1708	41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Writtt\Writtt\Writtt.exe	41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe
File created	C:\Program Files\Writtt\Writtt\uninstall.exe	41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe

C:\Users\Admin\AppData\Local\Temp\41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe
"C:\Users\Admin\AppData\Local\Temp\41a6289fbfee0463fdf54bb08f9f4d16d0c4938f7c5d32442b2fd3bd1afb7742.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Writtt.exe

Path C:\Program Files\Writtt\Writtt\Writtt.exe
Size 16.3MB
SHA256 6b113a59bf495cf9ef44a950993a58f8dabbf70a533c10b814f768db71d0f21d
MD5 82df134a2dfb16441c0273bfade860ff
SHA1 edc7eae4e066b72d58d26837e088147e07cdc8d5
SHA512 8b699c7671c7de104a1d752fd814b01c774912235e53741852de1151be409e0f33764d25b47a76a21c57a0a327a2c0deea105e6eeddbb9f447ad70f663857d8e
SSDEEP 196608:bTzERo/MZg7ZShYnS3n8uFqyyxqwJM/oDoYOtcWFv57OoJPQAwA8CIYBxdJz3Ftm:bo/g7ZSynYLeJ
TLSH
T128076B47E86511F5C0AAC935C9A6D152BB307C888F2427D77B60FB642F72BD0AEB9710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbECFC.tmp\InstallOptions.dll
Size 15KB
SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
MD5 cfc7c53e282b0a7c527e4ed091f17fcd
SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
TLSH
T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbECFC.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsbECFC.tmp\ioSpecial.ini
Size 1KB
SHA256 7c68816013741e26728d650d653f15417d7870f9cd2a70ae4b4353b83cffbfcd
MD5 f9fb039eba5682ef3f56c6512828cce7
SHA1 d9277f963b4cb661201b12a73cea9a6225a1afed
SHA512 a4da82a85fc7fb41d7159281541e7a818009db0b81d93f425ce0a1c0741893fbf446f5c639da1299a67eaec06243f3d0fb0b8d3ca222a75b8a3ae30874e0626f
TLSH
T1812190037AFD1604F2BBBB54FEB541759B3A7816A839D50D81C1090E09E6E408963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsbECFC.tmp\ioSpecial.ini
Size 1KB
SHA256 1e2bbc539eeb8d2ea890fae990cd75523640fffe2dfd7642cf8d38e75e6dc527
MD5 cc4799da6648d5fc4835e1cbb0516d20
SHA1 267f9ec4868b85c419ae4f46c61c7942918e13c9
SHA512 332551d8c9f8c3a2940946dc4662688c48f2768d8c7dd1c2e43bc091ccc9eec9fa0f77eb38e017cbb0faf80cf6f7b4aab3451cac88213cb2f44c07c16395bfc2
TLSH
T1BF118F037EFD4014E2BBBA48FFB5807597397851682DD50E81C10A0F44E6A808923BEF
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads