db8386c08d52daef58593beb22fa2de248c7e092f92e8ac4dfb5ef34fc199bcc

Analysis

max time kernel
298s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uninst.exe
Size 223KB
Sample260905-rffspadn8z
SHA256 db8386c08d52daef58593beb22fa2de248c7e092f92e8ac4dfb5ef34fc199bcc
MD5 baf32e36bd8529e5863cafb2f16fcc99
SHA1 80a37e8debc816b32a79df61a7f0299869ca8263
SHA512 58df391f37cd718a0d1052eb53ee52b5a8c512cd4046568a3ef7ca3d85ed484898a21f5c32e8fd97677b4a6bf133662aff6a6ba432667ee1ff5b2e621cdb54ce
SSDEEP 3072:H5BuYAVrgUCPnSqMSD+t+MHuR58lOCkqbjO:H50gUCVv+AVWlOCkqO
TLSH
T1632427C166B78F67E5BC16731462467E0E65AC331931862B6240FACFA8736138C3B776
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1540	Au_.exe

Executes dropped EXE 1 IoCs

pid	Process
1540	Au_.exe

Loads dropped DLL 2 IoCs

pid	Process
1540	Au_.exe
1540	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1540	Au_.exe
1540	Au_.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1540	3056	uninst.exe	86

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu50DB.tmp\FindProcDLL.dll
Size 27KB
SHA256 6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9
MD5 6f73b00aef6c49eac62128ef3eca677e
SHA1 1b6aff67d570e5ee61af2376247590eb49b728a1
SHA512 678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938
SSDEEP 384:DZoRF0XXUuJReQg0Tw67ADWBTgmldIogUD3GLgFmyaX/fVYcWJQCDmrinogRdBl:DZaF0HtTwuz9yu3KgwRX1nWJ1q+noI
TLSH
T12DC26C107C9042B7D28E5671A1E50F075B3F6E512AE65883CF256ADA2D612F0FA3F31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu50DB.tmp\LangDLL.dll
Size 5KB
SHA256 47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6
MD5 a1cd3f159ef78d9ace162f067b544fd9
SHA1 72671fdf4bfeeb99b392685bf01081b4a0b3ae66
SHA512 ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362
SSDEEP 48:apTVWFeApYx2lxaKe3yfeEIWCGWNpBWLGGrx3pMt4z8mtJ7HofYZVSLa:RFG0xaKkyfjIWTW7BYrhSbmtJ7/V
TLSH
T1D8B18331F3C08CF5C692453A28D337D6AA56BA141748445FCBA726AB2910DEBEF3D781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Au_.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Size 223KB
SHA256 db8386c08d52daef58593beb22fa2de248c7e092f92e8ac4dfb5ef34fc199bcc
MD5 baf32e36bd8529e5863cafb2f16fcc99
SHA1 80a37e8debc816b32a79df61a7f0299869ca8263
SHA512 58df391f37cd718a0d1052eb53ee52b5a8c512cd4046568a3ef7ca3d85ed484898a21f5c32e8fd97677b4a6bf133662aff6a6ba432667ee1ff5b2e621cdb54ce
SSDEEP 3072:H5BuYAVrgUCPnSqMSD+t+MHuR58lOCkqbjO:H50gUCVv+AVWlOCkqO
TLSH
T1632427C166B78F67E5BC16731462467E0E65AC331931862B6240FACFA8736138C3B776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download