c5795aef96fa6042b661ad1a7d47dfc69ea9dc43f644da70907398d3d97f712b

Analysis

max time kernel
148s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c5795aef96fa6042b661ad1a7d47dfc69ea9dc43f644da70907398d3d97f712b.exe
Size 4.0MB
Sample260826-pd59fsdl3x
SHA256 c5795aef96fa6042b661ad1a7d47dfc69ea9dc43f644da70907398d3d97f712b
MD5 9e1c1f69cedd35306ddd8e4d4b5ce3b3
SHA1 d0db05eb04fb36d2cd2f3dc732725398d88870b6
SHA512 b62c44329030f2d28edf7a69a161b68f888ba672f077a4a96923f7b1de8a0cc6f499118af9b7d429090102189448dfe8a42bea625ba1e3cbb266bc996524006d
SSDEEP 98304:Zejpmrmc2lAuv8lkcf5YjovKqGYiOE8oLj54Iz:o0mZlh5gyjovK65E8oXz
TLSH
T1F516DF167E8FC81CE6B15A35777DD6A011734A238F83089BB79F5E90FB70AC564B2602
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2548	c5795aef96fa6042b661ad1a7d47dfc69ea9dc43f644da70907398d3d97f712b.exe
2548	c5795aef96fa6042b661ad1a7d47dfc69ea9dc43f644da70907398d3d97f712b.exe
2548	c5795aef96fa6042b661ad1a7d47dfc69ea9dc43f644da70907398d3d97f712b.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	c5795aef96fa6042b661ad1a7d47dfc69ea9dc43f644da70907398d3d97f712b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5795aef96fa6042b661ad1a7d47dfc69ea9dc43f644da70907398d3d97f712b.exe

C:\Users\Admin\AppData\Local\Temp\c5795aef96fa6042b661ad1a7d47dfc69ea9dc43f644da70907398d3d97f712b.exe
"C:\Users\Admin\AppData\Local\Temp\c5795aef96fa6042b661ad1a7d47dfc69ea9dc43f644da70907398d3d97f712b.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:2548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

360NetUL.dll

Path C:\Users\Admin\AppData\Local\LDSGameMaster\Store\360Base\360NetUL.dll
Size 234KB
SHA256 139fdd92e6ddf1aac0761a68502b374daa32e82039621018511dc491ed9b4048
MD5 cd03029957ebc78c0ca7a6c02a9ca846
SHA1 0044114b8073781479044f0294701be9611be2ac
SHA512 14c641cb9536def0ddc1969d50b97b83a23017c97373e3ad74d3fbf9825ac81f3fdf8169281c8ad4cebd45d9c9ae05f752d553ba4653e620889b274479cb7c32
SSDEEP 6144:UY+WTYKgvoCAXYkgBJR9dwhJ+o9TBLuSz:UY+Wk5voCAXYkmP7Lo9TJ
TLSH
T14734CF127A80C833C1EB1534959AD77A5AFAB4301779C547BBD81BBD2E20783E6253CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LDSBasic.dll

Path C:\Users\Admin\AppData\Local\LDSGameMaster\Store\360Base\Utils\LDSBasic.dll
Size 2.1MB
SHA256 c4dba892a9a1fb675d06dd615c4fc079e9f4e12a8368e8bd18e37137ed567f35
MD5 c35ab236702291f1a2d090af8ea253d9
SHA1 d7f58f0f5fee6b26564af3c5d7ab6defe5a4608d
SHA512 87a3fa1927ad2fad117055411a471be95275a4d4bf99ee3ab522faee70067b239bb77ddd94c4300958607efd4a3fc071df2262754557fca2530e70f2c438a068
SSDEEP 49152:Ebr/dy1q8u2iKNs30Sk11FyJtnoQHiub/LYEBDUf:C1yI8uLn0BAV1CWYE8
TLSH
T180A59D12BA42C031E4E900B1627D9FF68C2C6B351B3945DBA7D40DA95D705E37A3AF2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgame[1].txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BJDESKSS\mgame[1].txt
Size 2B
SHA256 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
MD5 444bcb3a3fcf8389296c49467f27e1d6
SHA1 7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
SHA512 9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570
MD5 SHA1 SHA512

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\{53B9629C-D98F-45a6-BBCF-7AC5600FB881}.tmp\7z.dll
Size 1.1MB
SHA256 aa57160684feb240a85da677caaf7cf6a08b7349d89ae9cb4a3476884d80aac5
MD5 a46135bdd574092d85955070e72d5aad
SHA1 aad137b0a883fea22b7118778512ffc7865513bc
SHA512 72188f348d9ae33e2b5a7886c80667cc3015bfac170249537baa9e31abf8d63ca198903206feb64887f1d509a1b9bfc9f54ede8b3aa26bee3f5c4375e5c6a24b
SSDEEP 24576:0xb5vMX35l5UVrIdhcMEKWnttf7eePboHvVxSfBtll:0xbSz5UVrIdhnW1Pc96Btll
TLSH
T1CA458D15F7F1C0B4D98E56318A2CBBF550F8E71ECA1068C76780BE6E6F328D6C225949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads