30b15552574be26c71cd6bec46566f6a6234fc62fcdc59ac2c17613dc20f69af

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
30b15552574be26c71cd6bec46566f6a6234fc62fcdc59ac2c17613dc20f69af.exe
Size 10.8MB
Sample260823-wp7d8atwey
SHA256 30b15552574be26c71cd6bec46566f6a6234fc62fcdc59ac2c17613dc20f69af
MD5 430a2b9e2bc00dfa7a47876c95544909
SHA1 4a6896edf2346e82cd35051f5174f42c860d1c62
SHA512 2d79df218364a93fd20be6bfdbb113495847b616d29360c5d112bf1c6738bd2b6d06d9d0dd57dea09118240e55efff8ecd13de842d8707b9f46d44ea133af0d1
SSDEEP 196608:vJ8yPWW/1Qcp2GPMf0GS+p5ELIP0PxO3L+6hJpRzBkPuONPh4tkewSTiVf8I6:vJ8yv/aA4H1g+0P2CmbkPuONPatzwuw6
TLSH
T12BB633946914EFB3E1F213B18DBD99B0575F3DA8A85E630395B532C2ECE77A25C010AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4344	BCompare.exe

Loads dropped DLL 2 IoCs

pid	Process
4344	BCompare.exe
4344	BCompare.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30b15552574be26c71cd6bec46566f6a6234fc62fcdc59ac2c17613dc20f69af.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCompare.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4344	BCompare.exe
4344	BCompare.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4344	BCompare.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4344	BCompare.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4344	BCompare.exe
4344	BCompare.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 4344	2616	30b15552574be26c71cd6bec46566f6a6234fc62fcdc59ac2c17613dc20f69af.exe	88

C:\Users\Admin\AppData\Local\Temp\30b15552574be26c71cd6bec46566f6a6234fc62fcdc59ac2c17613dc20f69af.exe
"C:\Users\Admin\AppData\Local\Temp\30b15552574be26c71cd6bec46566f6a6234fc62fcdc59ac2c17613dc20f69af.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Local\Temp\nsbDE33.tmp\BCompare.exe
  C:\Users\Admin\AppData\Local\Temp\nsbDE33.tmp\BCompare.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbDE33.tmp\7z.dll
Size 1.3MB
SHA256 dcf03cae509739d2242b4fb65eeaf52ad316f999c4934c5c971606b3ed742380
MD5 13c006e362a0d918db33667684cb9abd
SHA1 da784ebccdf9a1606117ad2dabd9e329ff6a160e
SHA512 f5a1273a249ac8e9b75db1918da6bf0d95622df336572211e800d225162acd54b83b674b3692cfab1106c893ac60dae2bb5e57843c12d421b785dbb0915d15e3
SSDEEP 24576:k0p4+kpYxuzmZlGU4j4j/M5TfhfYBSGZm9AE/0vA9g5eYoWbDuzY295MEYK:k06+kpYtGU48/MlfR648A9Em029WI
TLSH
T1BB559E11F7B1C0B4D58D5630862DBBBA50F8E729CA20A8D777C0BE6E6F319D2C235619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BC5Key.txt

Path C:\Users\Admin\AppData\Local\Temp\nsbDE33.tmp\BC5Key.txt
Size 568B
SHA256 d9480796a2d1acdc1f9d9866b865cfb650dbefe932a18fbaaa7406cde88be79d
MD5 36cbad36cbf5e6adfe5affa0fac85694
SHA1 5973511a8461ec0e4c28bf8693a3affe85167b8a
SHA512 44e3129ce47f6ca77ff165b3a70df30e718bae973910f12f34dd7e6b3ca7481dd91671791d8a6f46afbec0ee9196a0d07c2c00e5874d72d15a4ea7de8ed8ea24
TLSH
T152F02696F95544310794D6151501183F3053CD6A8FD97CC8A03C5A9C0F6B488F25C49C
MD5 SHA1 SHA512 TLSH

Submit Download

BCUnRar.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbDE33.tmp\BCUnRar.dll
Size 331KB
SHA256 2a6bf612d52020e1479e9308a5ecd5e382f9f7b799e169a174a834c6e9bf4188
MD5 9a3f047220d30830e211cb0f02a04b08
SHA1 c335c723560d6fb416758c0e561e37826e174e71
SHA512 887b39ba298567a0a9bc0453c0c7e21bd2d481937dfc89c63388ddbcb9e27d1f522f8b7f127bc3ae0dee9eaf98a84d808f03a32cc94847f6368cc4f4edbd9c61
SSDEEP 6144:TR9op0t7ou7sLTUhCNc2U7gG9/gE1zQ5LmayLzlHtla3YNFFKdwevH9:V9oGt17mTUUy2Usg/7QIDz5tL6wevH9
TLSH
T18C74AF30B993C0B2E99E0970782D9FABAD3D6B601F7194CBE3D04CF65D202D16736969
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BCompare.exe

Path C:\Users\Admin\AppData\Local\Temp\nsbDE33.tmp\BCompare.exe
Size 35.5MB
SHA256 620f93d52cb819b154d5492a29d20441b232440996691b720ef2e9ab90117a2d
MD5 fd8b0918e4c406c23408ff61aa65ae63
SHA1 f844b327d590d13566462d465d5092d7a95827b0
SHA512 f921520af88a811cbb159eedd78a7cd0e502fb1d4c66f8ec69a24bd34980a86c652b8f3e332cd4a1f751c50347e8e37867d922e69cf9c82bcf3808b39fbd8686
SSDEEP 393216:KJ/+1Dn/7yvsiMCawXyA4it9N9Yhz2c4iERhz0w4NlPsJ8tG2IhejKLAYo5SCnF0:NSXfr0w4NlW2KLyIQtpLdpviBF
TLSH
T1B7876C16B3469136D857197ACC6FDAA0343EBDB01A2488EF37E47F3E1E397422916607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BCompare.tr

Path C:\Users\Admin\AppData\Local\Temp\nsbDE33.tmp\BCompare.tr
Size 426KB
SHA256 3c6076a1ec2cc7b66c2edfa877d15a4187852b58985805a148534bcf3f086007
MD5 2acf82fa9b989ebc173200bfe51cc567
SHA1 e502369eadd064d33fd43ff960dd5701f984b228
SHA512 9e0d49038c40889b995748525a42d4f230de08047ef4185f5d64f934cb48dc00a03cd2bdc6b30479edd636c99c46328eedd47fc9ed281836e41acb35e0fb50f4
SSDEEP 6144:QrHCBmlfif/WapJuxYK9jAqPq4ajJMttiE56CHlxu86GEsm0L7m4:QLC3TDSq4aWZxwsm0L7m
TLSH
T12094F94263ED2268FAFB7B352EB509650E76BE64F879C64C1254848E0DB5F04C8B2737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4344-35-0x00000000074C0000-0x00000000074C1000-memory.dmp

Download

memory/4344-34-0x00000000074C0000-0x00000000074C1000-memory.dmp

Download

memory/4344-37-0x00000000074C0000-0x00000000074C1000-memory.dmp

Download

memory/4344-39-0x00000000074C0000-0x00000000074C1000-memory.dmp

Download

memory/4344-36-0x00000000074C0000-0x00000000074C1000-memory.dmp

Download

memory/4344-28-0x0000000000787000-0x0000000000788000-memory.dmp

Download

memory/4344-38-0x00000000074C0000-0x00000000074C1000-memory.dmp

Download

memory/4344-40-0x00000000074C0000-0x00000000074C1000-memory.dmp

Download

memory/4344-33-0x00000000074C0000-0x00000000074C1000-memory.dmp

Download

memory/4344-32-0x00000000006C0000-0x0000000002A83000-memory.dmp

Download

memory/4344-42-0x00000000006C0000-0x0000000002A83000-memory.dmp

Download

memory/4344-45-0x00000000006C0000-0x0000000002A83000-memory.dmp

Download

memory/4344-46-0x00000000006C0000-0x0000000002A83000-memory.dmp

Download

memory/4344-47-0x00000000006C0000-0x0000000002A83000-memory.dmp

Download

memory/4344-48-0x00000000006C0000-0x0000000002A83000-memory.dmp

Download