71dc1985977dd5ca50095802973aa571572e87789b0c58120982109b0593b9ea

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
71dc1985977dd5ca50095802973aa571572e87789b0c58120982109b0593b9ea.exe
Size 313KB
Sample260826-vt7p4stamd
SHA256 71dc1985977dd5ca50095802973aa571572e87789b0c58120982109b0593b9ea
MD5 4077f46725bacba14f46f4816396e2af
SHA1 47fb659dbe941d0fca59a15fbf7a1fd38cd690ff
SHA512 44c649d361d5811cb0430202acbe6fde7511ade84c2987848a24b322b8154339d468feb0eece5934c91847c4b6af355d0f819d11ffd500ba7ea3f35c01997382
SSDEEP 6144:Yro9uEo2S1YnQmCX492DkwNP3qpYFx1PKR9bwMHCrwqdS1D/9n1v94dj:YrAu6/eIo4s1yR9lsc/adj
TLSH
T152642301253A90CFD8F40632D5E31967A77AADB3E0A8C24757D5E9BF3034B9AC1462B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4420	71dc1985977dd5ca50095802973aa571572e87789b0c58120982109b0593b9ea.exe
4420	71dc1985977dd5ca50095802973aa571572e87789b0c58120982109b0593b9ea.exe
4420	71dc1985977dd5ca50095802973aa571572e87789b0c58120982109b0593b9ea.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	71dc1985977dd5ca50095802973aa571572e87789b0c58120982109b0593b9ea.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	71dc1985977dd5ca50095802973aa571572e87789b0c58120982109b0593b9ea.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71dc1985977dd5ca50095802973aa571572e87789b0c58120982109b0593b9ea.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4420	71dc1985977dd5ca50095802973aa571572e87789b0c58120982109b0593b9ea.exe
4420	71dc1985977dd5ca50095802973aa571572e87789b0c58120982109b0593b9ea.exe

C:\Users\Admin\AppData\Local\Temp\71dc1985977dd5ca50095802973aa571572e87789b0c58120982109b0593b9ea.exe
"C:\Users\Admin\AppData\Local\Temp\71dc1985977dd5ca50095802973aa571572e87789b0c58120982109b0593b9ea.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tsu27BF9DC2.dll

Path C:\Users\Admin\AppData\Local\Temp\Tsu27BF9DC2.dll
Size 269KB
SHA256 cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
MD5 af7ce801c8471c5cd19b366333c153c4
SHA1 4267749d020a362edbd25434ad65f98b073581f1
SHA512 88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
SSDEEP 6144:N/rdStrfAftBVju6v+UvrBhMo27dOQnyddk:J3y6vHvrBhLYjnydC
TLSH
T108448E82F7A08437D5B3063029EB6B32B5FAFD324739C64E87619E953C65702B91931A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Custom.dll

Path C:\Users\Admin\AppData\Local\Temp\{4E676FEC-AC39-41EE-A305-E41B95844D1A}\Custom.dll
Size 91KB
SHA256 c568abf39b7c7be25a72e3ccb846a055ada002fa382c3431fd4fc8f755c42568
MD5 156e10be1df7468b247c4a6f629b1c9e
SHA1 b84da289fa8bec345109ac49e4ec6754179efc49
SHA512 326c826eae92d738d03af35caf0d35cc304cde4ce29c26d1da5360b7372ed01aa8d08a71029a3dd74b5c3d41f60c96a2aa22a18e66e776138a4bb911f9289433
SSDEEP 1536:K7xcx/juCKV+hVboYrEhySESy9GNGU6u1Go6eOYM++vvncLwU:K7qxa8NoYr6w5S8o6epM++v/cLD
TLSH
T140937D93F3F140B6D1F3463CAD25A32AD7BBFA305821995A93540E4DBFA8152F52C392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Setup.dll

Path C:\Users\Admin\AppData\Local\Temp\{4E676FEC-AC39-41EE-A305-E41B95844D1A}\_Setup.dll
Size 169KB
SHA256 cecd634e90c0908eca56369fa102009e35a2bd82617c2cb09bcf17f6b2c45337
MD5 d8bbf8e88cf9821dd260f2c41505344a
SHA1 4a527f16683c49f70f613ee2ed7185f164ff8df7
SHA512 2c1e4c8c31553183a90fafdc86a2ded69d6c963c1ab5573c5b68b0d67c7e0c41dee2d534283105d04d077a8e229b1cc855cc0e0a5f7a501bc36ddc1806dd9418
SSDEEP 3072:ZCdz+S4cNJtkAlRHAAMHnS9qkJUsCmcW/fpICcsRuUwZxcUdONKnNPZv8FK4Us9o:YN
TLSH
T13E0437D2EEC284D1F0E5533098BF8AD76E32B8115526CE0BA38C167D3D66346B941BED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download