a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe
Size 326KB
Sample260824-292blavdja
SHA256 a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73
MD5 ae5f2f7ace440ca63a6f5e177ff93b68
SHA1 df87540b6af75f79909d9ebfc739e929bfbc5ed0
SHA512 dca3129432d2c9cd6994008e1ab9fdb6f33588ea84345591364674f988bff8240d385bb1a8bd533437bf206b8c8da8ecefc358ee336b3fb54f4f9e4b9c742f9c
SSDEEP 6144:K9X0G7HCo89joe9fL6HrXUcxKterwHy9MtTHiytdjbWYaSFs/ktC:80IHCoK0epLorXrmekSORfne
TLSH
T1B7641212B290C467CE971570487EC7B6C6F182F8432D6F676B14376A3872AD34B1EE28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
6356	a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe
6356	a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
6356	a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe
4204	a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Diseducate.bin	a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
6356	a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 6356 wrote to memory of 2556	6356	a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe	90
PID 6356 wrote to memory of 4204	6356	a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe	91
PID 6356 wrote to memory of 4204	6356	a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe	91
PID 4204 wrote to memory of 1308	4204	a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe	92

C:\Users\Admin\AppData\Local\Temp\a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe
"C:\Users\Admin\AppData\Local\Temp\a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:6356
- C:\Users\Admin\AppData\Local\Temp\a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe
  "C:\Users\Admin\AppData\Local\Temp\a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe"
  2⤵
  PID:2556
- C:\Users\Admin\AppData\Local\Temp\a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe
  "C:\Users\Admin\AppData\Local\Temp\a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Users\Admin\AppData\Local\Temp\a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe
    "C:\Users\Admin\AppData\Local\Temp\a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73.exe"
    3⤵
    PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsc2DFD.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsc2DFD.tmp
Size 10B
SHA256 a7de06c22e4e67908840ec3f00ab8fe9e04ae94fb16a74136002afbaf607ff92
MD5 9a53fc1d7126c5e7c81bb5c15b15537b
SHA1 e2d13e0fa37de4c98f30c728210d6afafbb2b000
SHA512 b0bffbb8072dbdcfc68f0e632f727c08fe3ef936b2ef332c08486553ff2cef7b0bcdb400e421a117e977bb0fac17ce4706a8097e32d558a918433646b6d5f1a1
MD5 SHA1 SHA512

Submit Download

nsc2DFD.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsc2DFD.tmp
Size 74B
SHA256 d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
MD5 16d513397f3c1f8334e8f3e4fc49828f
SHA1 4ee15afca81ca6a13af4e38240099b730d6931f0
SHA512 4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
TLSH
T1D7A00256368156A4FEC3C8751F65704CE59D313704C644032A4D48C89D45067CE0B5D8
MD5 SHA1 SHA512 TLSH

Submit Download

nsc2F39.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsc2F39.tmp
Size 56B
SHA256 4d8bdbfa3852560bf6cbffa14560274a51da943c24b4dfd0d7aaf5c59a720960
MD5 18e9c8abf8f187eb17ebcfa7b31b44d3
SHA1 5f6334793b3657c715b06a55e934bf9167ae65c8
SHA512 8aff04733c8658881499e869fb3627ec6cdc173d36e10da2f56c10331087d62faf17fbfd4f10431a8d1249428d5888728dc4cce1d7682ef38508a872f9164f85
TLSH
T1949002291956A975E246E8E58C158A4795099514581B044106A5409879414DB851A545
MD5 SHA1 SHA512 TLSH

Submit Download

nsc2F88.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsc2F88.tmp
Size 29B
SHA256 1cd17ebc8f026d74e357291a799786fd75557cfb6752ab682fb941ae1e91dc2a
MD5 8c3ede6c7733ece88212b60aeab2f37e
SHA1 3f0fd925744587ec6cf82b8763d3bc585323aeca
SHA512 8c6c8452744afcd83c14c905a2f100a48cea59c96712747a0a72cfada0d1a1481031bf6cca75113a00deab10ea0222f1965d2d2965eab2ebbf60fac34850c915
MD5 SHA1 SHA512

Submit Download

nsh2EBB.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsh2EBB.tmp
Size 32B
SHA256 84ad1696fee7310b1652084e9d2ccea4695ea6d0a42c4b468eae5a8514d5115f
MD5 cb200cefbd9d39a149d1b1881ae19255
SHA1 9d52bc70e50a0549b214c18098decc9c66f214ec
SHA512 7612d838d6169ba6ddc46944f0798ab0ece163ebaae92cd155b3557d9a33c574a1f4c21628a15be537cb1f21e456e5d8e41d31f9a3c5ee841e3e2e6c41336f48
MD5 SHA1 SHA512

Submit Download

nsh2EBB.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsh2EBB.tmp
Size 46B
SHA256 255a8aae9f7bd61902eba2dc87a172352ab74a052d4d7b9a94bdde828efe52a4
MD5 86372d52d2d70d47592797b22ae5612e
SHA1 e7b8926f7a12e7aa4f0af85887955eb24d5d39e0
SHA512 5aa10d8fd002dd9152c814cbbc24c588c0d4490127ebcc1564df5d570189312abca1174624adac9abc09c950f402f6c3e64c4de73d799537bc36c6692918f6dd
MD5 SHA1 SHA512

Submit Download

nsh2EBB.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsh2EBB.tmp
Size 56B
SHA256 92efdfa375316c3b67f00f89f8d15bcf97c4b16a92cea9f5844c1697487ff363
MD5 7228edd937e748f98e3d249e004ed73c
SHA1 a27ca01916bff4d13e952271699601a42d7a0296
SHA512 ed829954a32e73ec089017324306cdd72b92daf98f71d74801a945b4d617e7ff4473185623ee18a2548d9a209249ae47285bedfdec636ea174cbebc5c0fdb270
TLSH
T1B390022E015589A1274784259E35E226571998540C3604231BED4549B81314A4307109
MD5 SHA1 SHA512 TLSH

Submit Download

nsh2EBB.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsh2EBB.tmp
Size 60B
SHA256 ab39228de402ea465bb777c5ce60d5b2f500cc18d8d7f5ea9f76a54b21dd7758
MD5 0679e381b19069d179f72dd4a02a5d17
SHA1 ffb862c30912634722271facf5e4b39780994102
SHA512 c53a1f531dbf02df927311141c9ecbe09a45dc216cfc3fc9e1195751201f342987ff36e64aff60fe13f1ec58c56b41a5b7e2b4ea7fe7a2d01e70c0fd8b2a07e6
TLSH
T1F5A0022E419589E1274784269E35E2265719A8544C7704231BED5549B81318E4307159
MD5 SHA1 SHA512 TLSH

Submit Download

nsm2E8B.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsm2E8B.tmp
Size 52B
SHA256 a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
MD5 5d04a35d3950677049c7a0cf17e37125
SHA1 cafdd49a953864f83d387774b39b2657a253470f
SHA512 c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
TLSH
T1E490222302000E28B8C380C308280000030A200088000080008008002002002CA8B280
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw2E2C.tmp\System.dll
Size 11KB
SHA256 d09a8b3ade4ba4b7292c0b3da1bcb4b6c6e2012e0ccfd5e029a54af73a9e1b57
MD5 4ca4fd3fbefa2f6e87e6e9ee87d1c0b3
SHA1 7cdbeb5ff2b14b86af04e075d0ca651183ea5df4
SHA512 cf0f415a97fdc74568297fed4f1295d0d2aef487a308141144ef8d5f04c669ef4795c273e745b81065429adde113fcdedf4c22717a7aeef60fdcd8d4d46f97f8
SSDEEP 192:EPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4W:j7VpNo8gmOyRsVc4
TLSH
T198325C5503504AF3E996863C00263B7FAF796A2095F14D53CFA39480FE2E5C9AD78352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4204-562-0x000000007753F000-0x0000000077540000-memory.dmp

Download

memory/4204-563-0x00000000774FD000-0x00000000774FE000-memory.dmp

Download

memory/4204-564-0x00000000775C5000-0x00000000775C6000-memory.dmp

Download

memory/4204-575-0x00000000774FD000-0x00000000774FE000-memory.dmp

Download

memory/4204-574-0x0000000000450000-0x0000000001736000-memory.dmp

Download

memory/4204-576-0x00000000775C5000-0x00000000775C6000-memory.dmp

Download

memory/6356-561-0x00000000741C4000-0x00000000741C5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads