3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb.exe
Size 12.3MB
Sample260831-fen7wsvdpf
SHA256 3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb
MD5 bf9e11ee6bd7a61ac0829f802e2c7fef
SHA1 35c23ffe93c04967960e29bbf944bea66a8c225b
SHA512 5e8ca5a0c7834ff710b0cc9cf6b2c9d01e036032e319cd6976640c304117e39f161f21ae16ac6cb872cc72a539219bfec40433ebea7df145a2c62f1a6ae6d5b8
SSDEEP 196608:rDbmlC0CPU8bPxYfklh7MWRit6r9RXRKnpn2Wi8hPeyjmZC+gx02VYWTGcQSKonn:rDbvbPCmYn6r9RXsNdP9me5XQ+pc+
TLSH
T18FD62327B28F633EE46949360A776951093FBA61651A8CB3C6F40D4CCF2D0A11E7EE17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4612	3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb.tmp

Loads dropped DLL 3 IoCs

pid	Process
5668	regsvr32.exe
6060	regsvr32.exe
4132	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4448-1-0x0000000000C70000-0x0000000000D4F000-memory.dmp	innosetup
behavioral2/memory/4448-25-0x0000000000C70000-0x0000000000D4F000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4612	3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb.tmp
4612	3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb.tmp
5668	regsvr32.exe
5668	regsvr32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4612	3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 4612	4448	3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb.exe	89
PID 4612 wrote to memory of 5668	4612	3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb.tmp	90
PID 2136 wrote to memory of 6060	2136	regsvr32.exe	95
PID 3688 wrote to memory of 4132	3688	regsvr32.exe	97

C:\Users\Admin\AppData\Local\Temp\3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb.exe
"C:\Users\Admin\AppData\Local\Temp\3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Users\Admin\AppData\Local\Temp\is-711D3.tmp\3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-711D3.tmp\3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb.tmp" /SL5="$400BE,11851075,848896,C:\Users\Admin\AppData\Local\Temp\3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\regsvr32.exe
    "regsvr32.exe" /s /u "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\f21e13b0_2b09_4aa7_8481_a800486b4835.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5668

C:\Windows\system32\regsvr32.exe
regsvr32.exe
1⤵
PID:3596

C:\Windows\system32\regsvr32.exe
"regsvr32.exe" /s /u "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\f21e13b0"_"2b09"_"4aa7"_"8481"_"a800486b4835.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\regsvr32.exe
  /s /u "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\f21e13b0"_"2b09"_"4aa7"_"8481"_"a800486b4835.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6060

C:\Windows\system32\regsvr32.exe
"regsvr32.exe" /s /u "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\f21e13b0"_"2b09"_"4aa7"_"8481"_"a800486b4835.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\SysWOW64\regsvr32.exe
  /s /u "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\f21e13b0"_"2b09"_"4aa7"_"8481"_"a800486b4835.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-711D3.tmp\3d0d91d0fcdd16e7bb270c57dd739d4ee33b2ca70564f9bfa7dc8c6a86b1b7cb.tmp
Size 3.5MB
SHA256 f2036cb4fda0f758a412378b41379981361eaa5cbe98136b3fbe1fb10407f2f5
MD5 d52540dacfb9a79f04c210c7f1f51ac7
SHA1 642c9511bdf10c1033c4b89366d7ec2c6f5609a2
SHA512 c4e305c82ce2797c7d61faa8fad1e7090b5517d42c7a2fb4460012d8ed05828ccaba520d0920234b955c30a993a352d2080f1d01c18cd78b2dd6f3c4aac38935
SSDEEP 49152:d44B+lNsHPWeelGdwSxQRw9CuL0wijepA8oGd9Tg70azpkf33339nNe:OIPp70wijepoGzgbA33339nQ
TLSH
T105066C13F389653ED06B1A3B683F9254583F767029138C579BEC3A4C8E795802E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f21e13b0_2b09_4aa7_8481_a800486b4835.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\f21e13b0_2b09_4aa7_8481_a800486b4835.dll
Size 4.6MB
SHA256 dae4333a8fd90383416a41df868094422e7960092cf3edbfef41bcb7b7b565f1
MD5 01779adb8bb7f76988a5d15a75d6a0ee
SHA1 99674770348f68ed7a4440958ade2a228c98dc92
SHA512 c2b058caee752e93215c0961abc86c0151526d60a8351280972d0385c6ee7b2ae38de8b0eceb4d8472fd7d2f68d75a4c93b786ac02dc4f6ef74dc4e380c12c7e
SSDEEP 98304:99xTFj/XpKQtR7Sd5v/YYCMfqv4EI5BLH2jvTkroOLdzwEj:99xTFjPpKQtR7Sd5IFMSQTHCvTkvzwEj
TLSH
T144268E11E5606875DD9B1930105FE33BE6305F24803ACAA7DF799EA4ABFF791A848307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4448-1-0x0000000000C70000-0x0000000000D4F000-memory.dmp

Download

memory/4448-25-0x0000000000C70000-0x0000000000D4F000-memory.dmp

Download

memory/4612-11-0x00000000039A0000-0x0000000003AE0000-memory.dmp

Download

memory/4612-10-0x00000000039A0000-0x0000000003AE0000-memory.dmp

Download

memory/4612-8-0x00000000039A0000-0x0000000003AE0000-memory.dmp

Download

memory/4612-12-0x00000000039A0000-0x0000000003AE0000-memory.dmp

Download

memory/4612-13-0x00000000039A0000-0x0000000003AE0000-memory.dmp

Download

memory/4612-14-0x00000000039A0000-0x0000000003AE0000-memory.dmp

Download

memory/4612-9-0x00000000039A0000-0x0000000003AE0000-memory.dmp

Download

memory/4612-24-0x0000000000370000-0x000000000070E000-memory.dmp

Download

memory/4612-6-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Download

memory/5668-29-0x0000000074480000-0x000000007484F000-memory.dmp

Download

memory/5668-44-0x0000000074480000-0x000000007484F000-memory.dmp

Download