87259d5785c4301542f3728a063b84246a681d12230e9e777b2b1f71ea099320

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87259d5785c4301542f3728a063b84246a681d12230e9e777b2b1f71ea099320.exe
Size 9.0MB
Sample260813-ss613sbp5x
SHA256 87259d5785c4301542f3728a063b84246a681d12230e9e777b2b1f71ea099320
MD5 42c6d0164f906c89dfe8ca6e7c0fa222
SHA1 d6eab93d5db8df700d14cb6d03c497effe4453d3
SHA512 cad77a2db2ed666ed71735ba8148cebc3a13aeaa741b3b4457a238f0a8831dd6238c669a8af5085fa77333e31eda32e9e03c4eb28582531dd17ec0f7831ed429
SSDEEP 196608:Ei70yAyMG4gwrra4fD7yYaC6clzo+9EqYRfxlGJ933QL:ExO4gwrN7yYaDoo+DYBx8b33K
TLSH
T1119633D579A541D4EC7A77343E773C9C1D17BE2086A4758EA3383A0B6FE352AE663080
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3660	87259d5785c4301542f3728a063b84246a681d12230e9e777b2b1f71ea099320.exe
3660	87259d5785c4301542f3728a063b84246a681d12230e9e777b2b1f71ea099320.exe
3660	87259d5785c4301542f3728a063b84246a681d12230e9e777b2b1f71ea099320.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\d3uceY\Clipcat\Clipcat.exe	87259d5785c4301542f3728a063b84246a681d12230e9e777b2b1f71ea099320.exe
File created	C:\Program Files\d3uceY\Clipcat\uninstall.exe	87259d5785c4301542f3728a063b84246a681d12230e9e777b2b1f71ea099320.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87259d5785c4301542f3728a063b84246a681d12230e9e777b2b1f71ea099320.exe

C:\Users\Admin\AppData\Local\Temp\87259d5785c4301542f3728a063b84246a681d12230e9e777b2b1f71ea099320.exe
"C:\Users\Admin\AppData\Local\Temp\87259d5785c4301542f3728a063b84246a681d12230e9e777b2b1f71ea099320.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Clipcat.exe

Path C:\Program Files\d3uceY\Clipcat\Clipcat.exe
Size 15.8MB
SHA256 7f56bd45230a13b70420437880cd359f5397dbdc47fd649e0416bee0003901d7
MD5 05e5c3ca56206954b4cf029fb57ffe1d
SHA1 6482bf6ff19b8447c1756ea8a1bd3d08b39e334a
SHA512 6055697e14c3a0ab0ebe02a2b66379b303408622bbbb38aa63ddfed6ae9b0a661f4ff25a92e23a65c89478bc14414c5aa8c6ffbeaa928ff1904d215a37d879b1
SSDEEP 196608:7f9XfujHE9HSDGTd6RY3bdRcBlxrjYlu:7FfuT7UYJgu
TLSH
T1C0F66C47E8A101B5C1A9D574CA66D263BA713C889B3023D76B50F7383FB7BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiEE5F.tmp\InstallOptions.dll
Size 15KB
SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
MD5 cfc7c53e282b0a7c527e4ed091f17fcd
SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
TLSH
T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiEE5F.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsiEE5F.tmp\ioSpecial.ini
Size 1KB
SHA256 3ab59327c6e7f7606ed7c8141445f659667430e2c3654add2d4f885ed8f6df79
MD5 95c5dd71708244778fe03c7a7991d09f
SHA1 e33b03bd5ff1033220108da1dd9ca3f2065dcb3d
SHA512 db6e4df3cc63fcc9ceea75daf287d0e3ab6f267a6ffe8bb3d6221027916fb1ff149a451a5609dbe14ed6ad70b1565409a677ac58efd2297fb8f2851782d14e24
TLSH
T12D116D037EFD5014E2BBBB58EFF580759B397851582DD50E91C10A0E48E6A808923BEB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsiEE5F.tmp\ioSpecial.ini
Size 1KB
SHA256 c2b166add099b0dd570d9db8b886d6a09b1ab0dbe6727ce732372800a96b14b4
MD5 398e717468301816244b2b0d79e8194d
SHA1 7cd3962352a765839f33097c4c4c2d0453f418ed
SHA512 ffb3c54bc9a45d71b89ce1ed6a94a5edb681371b0d87df5612ce79dcaabd573735d0d02eda0d1ecd8c30cf42a76a101e6d3e260b309c3aa0599ed30f4c6d6a94
TLSH
T10F116D037AFD5014E2BBF748EFF580758B39B855582DD50E91C10A0F48E6A808923BEB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsiEE5F.tmp\ioSpecial.ini
Size 1KB
SHA256 0381424faa9554859b9df53a2ca0608184d62d34e62f4d216a276f9c8e28890f
MD5 47e481ccd1ffdab65a033bb601074ec5
SHA1 7263f8b1bb3f4a95517cba42657c095f9706bd33
SHA512 3f785ad8e84b48294af7e68eafdc07d07e6659d93e379b94185856c3b8c0e066c53c82354e376d0bc0d2f5b26700fe2dd72ef28af85efac82c9ec04e065a540f
TLSH
T1E821AE437BFD1504F2BBBB54FFB540759B3A7816A839D50E91C10A0E09E6A408963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads