2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1

Analysis

max time kernel
149s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/08/2026, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1.exe
Size 314KB
Sample260830-1yllbs1cmg
SHA256 2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1
MD5 babbfa9c2837d5d4c953b6deb9b4363c
SHA1 48390616920f6a98dda8367a4195e4787ef187dc
SHA512 91757772014ae34d138df232cefcbdd658a0df1e04e83748a2142373445a8a873df2d03f5978ae88f56f6178d7163fc69ee8bd187e0ef6837fbd63fb80fff148
SSDEEP 6144:o+K03SwpNXT2TPGLURQN3vTLWBQ/7TzttuCMNhGK6DgsQQYO:p3Bxq7HqFvfW6jTz3uCMNQKagQ
TLSH
T12C6422110BE898BBDD8707F542B253E6EAB5CA02A625E9477B907F2F7B33097D8041D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
412	2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1.exe
412	2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1.exe
412	2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1.exe
412	2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1.exe
412	2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1.exe
412	2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1.exe
412	2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1.exe
412	2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1.exe

C:\Users\Admin\AppData\Local\Temp\2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1.exe
"C:\Users\Admin\AppData\Local\Temp\2e767a8e51b002ff7f6cb69bca4e0787b3ba0310040ab73a17c76036da73edf1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsisdl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz6A5E.tmp\nsisdl.dll
Size 14KB
SHA256 72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245
MD5 1dadb63a5dfaa0679485c5dbaf96033f
SHA1 d1717aab683c55bd13bbd520d2a91178efa0d676
SHA512 46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722
SSDEEP 384:wck76gi51kE5aYOMLDC4UnDp9B0Jc5HNw2PE:wck76gibLCMLDLCx04HNVPE
TLSH
T149622A51691009F6C761127430D73BBE6BB38E314B1585C39BE39A8EBD24A039676ECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download