Overview
overview
7Static
static
3windows_10...64.exe
windows10-2004-x64
7windows_10...64.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3Uninstall.exe
windows10-2004-x64
7Uninstall.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3bin/ANN.dll
windows10-2004-x64
1bin/ANN.dll
windows11-ltsc_2024-x64
1bin/acyclic.exe
windows10-2004-x64
1bin/acyclic.exe
windows11-ltsc_2024-x64
1bin/bcomps.exe
windows10-2004-x64
1bin/bcomps.exe
windows11-ltsc_2024-x64
1bin/brotlicommon.dll
windows10-2004-x64
1bin/brotlicommon.dll
windows11-ltsc_2024-x64
1bin/brotlidec.dll
windows10-2004-x64
1bin/brotlidec.dll
windows11-ltsc_2024-x64
1bin/bz2.dll
windows10-2004-x64
1bin/bz2.dll
windows11-ltsc_2024-x64
1bin/cairo-2.dll
windows10-2004-x64
1bin/cairo-2.dll
windows11-ltsc_2024-x64
1bin/ccomps.exe
windows10-2004-x64
1bin/ccomps.exe
windows11-ltsc_2024-x64
1bin/cdt.dll
windows10-2004-x64
1bin/cdt.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 00:17
Behavioral task
behavioral1
Sample
windows_10_cmake_Release_graphviz-install-16.1.0-win64.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
windows_10_cmake_Release_graphviz-install-16.1.0-win64.exe
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
Uninstall.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
Uninstall.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
bin/ANN.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
bin/ANN.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral17
Sample
bin/acyclic.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
bin/acyclic.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
bin/bcomps.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
bin/bcomps.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
bin/brotlicommon.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
bin/brotlicommon.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
bin/brotlidec.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
bin/brotlidec.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
bin/bz2.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
bin/bz2.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
bin/cairo-2.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
bin/cairo-2.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
bin/ccomps.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
bin/ccomps.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
bin/cdt.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
bin/cdt.dll
Resource
win11ltsc2024-20260709-en
General
- Target windows_10_cmake_Release_graphviz-install-16.1.0-win64.exe
- Size 7.7MB
- Sample260905-ak5tyaba24
- SHA256 46f3b8b412a79915cf8e08bdce6542401bd9efca98ce282f3c5c5b56211e1761
- MD5 3044a866f496821c4eb89e861ceefafd
- SHA1 446664a27d6a6731a8c3287dd2db6a58b051194c
- SHA512 bfd34a0ce08f57cdd1c7d8808b403c8c20fa73c00af05d4dfa6e215cba070a31806649304e7437e449a1e2b3e6114d85c8b38b6c1f3e5a56464968036421fc36
- SSDEEP 196608:OMsGXOIB/AJm0qdDMJcFUqgUsoRWPpGORO2z24:mY4JmldD72qzWPAeO2C4
- TLSH T1D0863358A3ABF383D2296A367BB35A9B4DF932534405D8C37FA021106FB5D50DE2D782
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 4992 windows_10_cmake_Release_graphviz-install-16.1.0-win64.exe 4992 windows_10_cmake_Release_graphviz-install-16.1.0-win64.exe 4992 windows_10_cmake_Release_graphviz-install-16.1.0-win64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windows_10_cmake_Release_graphviz-install-16.1.0-win64.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsfDD0E.tmp\InstallOptions.dll
- Size 14KB
- SHA256 31944b93e44301974d9c6f810d2da792e34a53dcacd619a08cb0385ac59e513d
- MD5 5f35212d7e90ee622b10be39b09bd270
- SHA1 c4bc9593902adf6daaef37e456dc6100d50d0925
- SHA512 7514810367f56d994c6d5703b56ac16124fab5dfdcfbe337d4413274c1ff9037a2ee623e49ab2fb6227412ab29fcc49a3ada1391910d44c2b5de0adeb3e7c2f0
- SSDEEP 192:E4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjaK72dwF7dBOne:tn3T5KdHCMRD/R1cOnrja+BO
- TLSH T187622B55738488F3DBE2003E785237079B995565B4929ED2CA275FC6687B08D7EB2303
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsfDD0E.tmp\NSIS.InstallOptions.ini
- Size 723B
- SHA256 d18489f85a6b6ac0d8cc32d2373823cb54539ce4246b980af2b9ec1c02c71ea4
- MD5 8dfc52fdaeff73d3994993c3c877c719
- SHA1 de23117e22cafa76e99c9a8cc2fb4a1125db5ecb
- SHA512 6b0b49aa27193e92c845a8008e9ecedfad9819db33633ad6e3bf690dd7e3354358e9b02f24e3ba56ba101f81306975dc852ff44c6f0f6814dc7dbd72fb738707
- TLSH T123012844D04AC3759030926114BFAAF67BD0296D26422898F2D894C3CB85DDA89BDAE4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsfDD0E.tmp\UserInfo.dll
- Size 4KB
- SHA256 943b33829f9013e4d361482a5c8981ba20a7155c78691dbe02a8f8cd2a02efa0
- MD5 acbda33dd5700c122e2fe48e3d4351fd
- SHA1 2c154baf7c64052ee712b7cdf9c36b7697dd3fc8
- SHA512 d090adf65a74ac5b910b18bb67e989714335e7b4778cd771cff154d7186351a1bebbc7103cca849bdfa2709c991947ffff6c1d8fdf16a74f4dfb614bce3ff6fd
- TLSH T19F81627B93E01DF3D4580BB700974CE7A2B5CE701751011F4A4B5A8A1190E37ECAEB19
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsfDD0E.tmp\ioSpecial.ini
- Size 667B
- SHA256 c2176067506ef3f4168fafa730e7cbe28ad9c72d19f867a5c030def4d41bd56c
- MD5 a447196a7ec6ad15e57da0e0722a5279
- SHA1 2ccefe3ef2dbc5f15801dda91b3db87c5e36f48b
- SHA512 ca0906977f33e2e32130c0190f7fbf6b220ccca37c3d71732de12c0ded12ae56536aa5e459d63f5a5c17f4ebe79eac6be9803cae5cdb882db6e9556d11759346
- TLSH T151019E89841FE3290420109674FD37A697D02C2C47223CF6F0529886678CDC38EE9ED2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsfDD0E.tmp\ioSpecial.ini
- Size 706B
- SHA256 53444f05fc46da95904e556390f665f342fcbdc02790add0aa457ecb7b3dc753
- MD5 26aaa9ae347fe4b6733fa7c0255178c2
- SHA1 75524ee461995a6577ba4816d2a0e56d98badbde
- SHA512 66a372369138e64235ceb55d1f1545d13a0294ceb9cef03f3fe270238b95291d340b8430f544552b09d609fc4d6cad54044d1093875ca52f065bcb6a3ea024af
- TLSH T1A2019C88845FE368042010D260BD37A657E01D2C472238B5E0529C865788DD38AA8AC2
- MD5 SHA1 SHA512 TLSH