0d151bae1e6f8fcf295a20cac617c4acab4389046cc76441411ab60be0397950

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d151bae1e6f8fcf295a20cac617c4acab4389046cc76441411ab60be0397950.exe
Size 126KB
Sample260916-xsghmsvbqa
SHA256 0d151bae1e6f8fcf295a20cac617c4acab4389046cc76441411ab60be0397950
MD5 567d5d84f375eada19479e946b6727be
SHA1 c7b466da4edc3adf61d16e950a16dd936262199e
SHA512 2c0de1452738d14a00ace51a6d3748ed0fa60358b6b530847184230514fdf4f1219ccd45cccdc5a89883a328172c2739a9b4f5af802e4b5c721620e560bd7172
SSDEEP 3072:vQIURTXJPeoh+YSZ158zIrTTU2KgXaU+eak9:vsxhhSPZo2vek9
TLSH
T16CC3C04D29CD6C73D6734E712BB2CB6AE2B6EE700D61522B1713FB7A38722526900257
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery installer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	4028	0d151bae1e6f8fcf295a20cac617c4acab4389046cc76441411ab60be0397950.exe

Executes dropped EXE 1 IoCs

pid	Process
800	YesMessenger-full-installer-sign.exe

Loads dropped DLL 9 IoCs

pid	Process
4028	0d151bae1e6f8fcf295a20cac617c4acab4389046cc76441411ab60be0397950.exe
4028	0d151bae1e6f8fcf295a20cac617c4acab4389046cc76441411ab60be0397950.exe
4028	0d151bae1e6f8fcf295a20cac617c4acab4389046cc76441411ab60be0397950.exe
4028	0d151bae1e6f8fcf295a20cac617c4acab4389046cc76441411ab60be0397950.exe
800	YesMessenger-full-installer-sign.exe
800	YesMessenger-full-installer-sign.exe
800	YesMessenger-full-installer-sign.exe
800	YesMessenger-full-installer-sign.exe
800	YesMessenger-full-installer-sign.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d151bae1e6f8fcf295a20cac617c4acab4389046cc76441411ab60be0397950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YesMessenger-full-installer-sign.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0007000000024353-35.dat	nsis_installer_1
behavioral1/files/0x0007000000024353-35.dat	nsis_installer_2

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 800	4028	0d151bae1e6f8fcf295a20cac617c4acab4389046cc76441411ab60be0397950.exe	88

C:\Users\Admin\AppData\Local\Temp\0d151bae1e6f8fcf295a20cac617c4acab4389046cc76441411ab60be0397950.exe
"C:\Users\Admin\AppData\Local\Temp\0d151bae1e6f8fcf295a20cac617c4acab4389046cc76441411ab60be0397950.exe"
1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Users\Admin\AppData\Local\Temp\YesMessenger-full-installer-sign.exe
  C:\Users\Admin\AppData\Local\Temp\YesMessenger-full-installer-sign.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YesMessenger-full-installer-sign.exe

Path C:\Users\Admin\AppData\Local\Temp\YesMessenger-full-installer-sign.exe
Size 7.5MB
SHA256 5024ab3fb5a3b67cb8fd1fbb4bb99fd249d94fbaaa7c82cfad09dc22d1251d48
MD5 7c2642a05bd07ac4ac84d82dfd3ffde8
SHA1 b055e74ccaf9540ac3158acc8a46c6e5dd55aa07
SHA512 d02d4b9a6542efeb3c8770e2c7ea801c4b99654b84f933fb049c909a1e4a2026ad5206e6288276b316d47f9bd9eb6bfca83cc2a2274ec7f13ee92d442119a371
SSDEEP 98304:VEApzaC8SRiHcKu8nWOhAJp1mUdxvG+VlLPwiGyytkWLleUd0X661fLYjq+GqjaS:ZEC8SROcKu8WOWmUdx+0kJyk5et9q8
TLSH
T1498633301E1E1D1BD66A03B64D82DAE35F35FDB08F6E6941A220F2F997358A4126C1DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj37.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoreInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsj37.tmp\MoreInfo.dll
Size 7KB
SHA256 569d62345f6c915236772fa2575d1806cd2bfe089505807cb477618f1eeccf99
MD5 80e34b7f576b710d100f6e7c0bed0c2e
SHA1 2b5b895034d41ee0d0d01bf650594ad0d1346662
SHA512 f5970c192b7089040fd1cf26e5cab131879b91722dff0216cdc735f9cfde1eda061409b579eb0f11e3b32e5513e34bbedd4050b75bb1b2acc81be814c2c6c59b
SSDEEP 96:lvIIAHGrJ65YtNxxDuekBSE4OTpsxKaVK4:5IVA65CNxIHk9ayxKaVK4
TLSH
T1A3E1A531B3E001FDE4CB06352C334B699D75B920EA25996F2652098E3D72A48FF32776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsj37.tmp\ioSpecial.ini
Size 731B
SHA256 d0258de4b515e10d4d4e8eb556a1718420720f16ceb5a5e2a7dd7a028493468d
MD5 e37c336245df9f8a81c95a5d7d93a2f5
SHA1 7612a9d48c576f8b6a314b04ba25002a2757587c
SHA512 6e7c9d6a2b5d9fb8e3f7ad251de5834ff6aa03c140bbd39c6b44b1a581239cbb37d7f20a1d276155664c076ff0e288e83e83111a154eec09e777ede1f8eedfa8
TLSH
T1E20115C541AD47140C41621B6DBA7A5313905E305B0BB5F6F8634C8B138DCD997FE782
MD5 SHA1 SHA512 TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsj37.tmp\modern-wizard.bmp
Size 150KB
SHA256 dedcb0d01a26eeaf733f4e811d959c9f6e46f9885c4c488f4399f61e65b04336
MD5 cd0038e517da003c479d8121d6a0a497
SHA1 d9e5eb2e65d1918df03a30a68638a9d0fcaa41a3
SHA512 71d965c55c3b45b21788b89a8ebcffa8f841828156a2f7b754fb534ec5b46fed6525e475bf451dbca9397f8212e0c151f698a019664f7875d934d6e02804b0eb
SSDEEP 1536:fmr1DlfAnMuPDznQ1OBf9SQnVVjklP6EJGtASCrX:qxlfAMuPDzQwN9SaPgj8F0
TLSH
T10AE34DBB1F6964937F2FB1BF8B7917A8B8984FFB4505548B26C2B11874367319A03432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallationType

Path C:\Users\Admin\AppData\Local\Temp\nsjF337.tmp\InstallationType
Size 808B
SHA256 38a6c8d62313b93feb5b9b5c76463d9e90b0f2fad61ffc21e46322d998df2d3f
MD5 e8cdf3f7c10e32b129b0c16446792d84
SHA1 273885c86010f877e47cf4176572f717aa6bbea5
SHA512 c201cdaa05cab52cde24f6294eb2db975b347f8074e8fa5a166d645c66afc8d5468168d72c9addd63d47f2a7101f06ae445878592954ad82d5a5044096c8a47b
TLSH
T18E01AB889589D77A8820E11A483B39E533E01D384B193CA4F6E0148BA789DF5589D686
MD5 SHA1 SHA512 TLSH

Submit Download

ShutdownAllow.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjF337.tmp\ShutdownAllow.dll
Size 3KB
SHA256 c6518731ae740494bdd87c53a43086be7f0ce125f728b2860a014235cd56134e
MD5 db401847c04d665a6f83dcafdd6ac23d
SHA1 bdbdcf5baaedd62d8d3f471693ef99d1fea60d7a
SHA512 c204bcd55d87cabfcdb79ca2230ae0e89425f2c7e67b46d3a04937440cdfbbe3d9cafa5e52a8ab5d4539a3af4710ce44624476fa42602edb23cb549aa77ecd71
TLSH
T1CE51F197D79596B5E25103BC46D7015877FD472723C7811FBB4D012A7B90E886CD3760
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjF337.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

header-install.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsjF337.tmp\header-install.bmp
Size 25KB
SHA256 b998ac8ef27daac68eac451c91392b1ef34b47fb3b412a6a55250ce362ec9358
MD5 c8eff9a5cbaf95dbe8195f52eb4d36d2
SHA1 91cbe619cc095920c472f089417b7360f051707b
SHA512 2fff71a56c398b7df127c55407da316ff591d4572dcca400bed7fd33291b87bfec41136fc9850a60937724ccac8bf5dab025d701064040199dea4b045ff0de9b
SSDEEP 192:eWS+GCazRa/yqYLYqHbMb3n4Ijic0dXVjU89/X+qTNnase1J0powWM:eWrGDUNYLYpT4iifjU89jnaZ70powWM
TLSH
T1B1C2C2E2438C0E55C8557C676828DAF67E98BDE71718BBDD8C88F4921B314EE230CDA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjF337.tmp\inetc.dll
Size 24KB
SHA256 0537e86a8940e8c516330c1e646bf46cb62d79fc5a9add557c5050b40fa9f346
MD5 eff1d9f80967c384e8d25c5a6369af1f
SHA1 1bad344a6f8a991e2017d79113e1e54f0dde32b8
SHA512 cc824bcf581182c072df0e59c4d5af73fd5768215e18585e94d15617cda224763b62bd36a24510766e1bd651da05f024e6b6b9b0eaf3b6371f119c508a5a1e18
SSDEEP 384:uucP6dFG0upnGsV5Zrf/d5Yg7MJ9/fxCSULpiT3ioyAkVZ0Ac9khYLMkIX0+GTQZ:u96/5GV5xf/dFQfISNT3jyAOsS
TLSH
T1A6B24A845E1824B7E7791D71B4E67F338B6BEB90355A404BE73363DC6CA4202B92B213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads