48c57d40d4385a664b142fce547c927619f8ae3b3e8658c85897113ac90c900a

Analysis

max time kernel
298s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MangoDisk-1.0.3-windows.exe
Size 5.3MB
Sample260816-vpcdeasfjd
SHA256 48c57d40d4385a664b142fce547c927619f8ae3b3e8658c85897113ac90c900a
MD5 b8ccd066745221560ac6d8c5ab0a52ba
SHA1 30a27b3244c975575158d1f10840d0a7de9a4d28
SHA512 59f409934dfac4ccd4b96e51e101f6ad26393f3a3ebf1323f3edf64b5318481c8cb96d0fad6bf679d7e623d39a36f2d2faf42136167adf26a061c79199776a5d
SSDEEP 98304:QngaqE58YICLhejSociCZN8G9dKlk+lTqzCDIvlSEkDoTIZu2NQ2mYL2EXh:Qnd5TICcWD8ACttqzLSERTIZkZY1
TLSH
T10C4633321F439566DC2C18F441FBD086B853E0B382E149FA1798F36A3B64D749AFA764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Loads dropped DLL 6 IoCs

pid	Process
2480	MangoDisk-1.0.3-windows.exe
2480	MangoDisk-1.0.3-windows.exe
2480	MangoDisk-1.0.3-windows.exe
2480	MangoDisk-1.0.3-windows.exe
2480	MangoDisk-1.0.3-windows.exe
2480	MangoDisk-1.0.3-windows.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MangoDisk-1.0.3-windows.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2480	MangoDisk-1.0.3-windows.exe
2480	MangoDisk-1.0.3-windows.exe

C:\Users\Admin\AppData\Local\Temp\MangoDisk-1.0.3-windows.exe
"C:\Users\Admin\AppData\Local\Temp\MangoDisk-1.0.3-windows.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp22B.tmp\System.dll
Size 22KB
SHA256 276505e4f47760f706338720199ac9dd9391aed134ede25a9da49058dbbd0c47
MD5 4477db0614ea134e6a5ed631a47be009
SHA1 08422a9711f59bf76ef12701945b23dc05592c39
SHA512 e4d6fa4a878c83c6410c388ed9e6faf158008a8ccd63b18e420588d65e5514d3e9c8cf07ae0d500b79229939b5a0ad7a577009593b1bcecf51301911f6b7cc36
SSDEEP 384:E/Qlt7wiij/lMRv/9V4b4rAIYicgl/GO3fy8RbmL4nNyK2f:EaeiijipNJYicgoGf5AL5f
TLSH
T18FA27D5386A08CF1ED125C3034D46F3BAF7A79991AD085D3A3E6C091AF503C76ABD297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsp22B.tmp\modern-wizard.bmp
Size 150KB
SHA256 6c38316c435ab5af4e5a1585de9465bffb9e9b586bcbb30786117190d61e0e8c
MD5 4c43c345df0901178cd3207adcd794b5
SHA1 2ff0e8959e0478fb2025531f134c237219cc06fa
SHA512 351bb7baedb1a0b986d34566d7e1f159c951bb03c19e3a61ce45603eb7490f1b80c9976f819f174af6127817ba961d400fb93cbd8c58888139145b811c198033
SSDEEP 3072:GsqXFIXftnxa7vWMX4ivhFMKc/2tgA3sGDr3sF86F4Y8rR35FD5BD89mt144bj6/:GrIX1xa7vWMX4ivhFMKc2tgA3s2j4F4q
TLSH
T1EAE3A7AFC07E51DD3C4E0BFE961519CB9DBB2BDD18113FAC3B2D6468693016A90DAA04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp22B.tmp\nsDialogs.dll
Size 19KB
SHA256 d0b94e77d18f9d2188723eac0d921c30ca16ab87275b51ab82bc9a078f1d669c
MD5 55c44aa8b8a3990a97dd88740c13b83e
SHA1 908328337715790c5d7c2434e17786ea9d23a01d
SHA512 5361f68628031b7317dc9ab148d589f81ea361580f4622e627c4b5199de866f4fce826929cf3bd717dfd9be4f94814b175774f8c5b3f6e070ff1d1af49af91c1
SSDEEP 384:5A7k8985U30WAw0htIFc5IYicgl/GsePrfy8RbmL4nNyVHlv:aNi5U3/Aw0fkYicgosqrf5ALrx
TLSH
T15C928ED385D02C33CC93593034D41A3EDEB9675464D19DC2A267C9496B613623F7C3AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp22B.tmp\nsis_tauri_utils.dll
Size 43KB
SHA256 6011fc421b32d9c2717e6e078988ac0e19588a390f72d7498b054345172d2ae1
MD5 2f62051ad4d19ad7e061a8ade69d24e6
SHA1 bedb6d65e5a8484c4d753077e2de885c3d6caefe
SHA512 dce04c6cb471e39406676681942da89f45f14333db8824dff004cd5988238cb8ae736714dae505da5494d7bd16092a059dd8722c8c8ad3e46e0aa66de92d0a12
SSDEEP 768:y/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG/Yicgo75AL3:0wODZzTrAV5Oevq4DtXHVG/7GW
TLSH
T10F137C49FDC47D66D6CF04702488463E9A7FC8081A40C99BE3615EA3CAD2332AED916F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download