818bfda0ec36a0fa83624397b7af9eefb8cf6a22a021a790a3c6c9b743f6cf63

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/09/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
818bfda0ec36a0fa83624397b7af9eefb8cf6a22a021a790a3c6c9b743f6cf63.exe
Size 364KB
Sample260917-wtcqeahd48
SHA256 818bfda0ec36a0fa83624397b7af9eefb8cf6a22a021a790a3c6c9b743f6cf63
MD5 b568fdf2d302aa60e1bdd3ee24403145
SHA1 20be73507e51bf3fe2de3082b28ac23fbb369dd1
SHA512 3674ab3fc2d5e75b3f849405d323537d276b71139aaf5207a50e4da53d3dd965a80f33b1d1402a5bcbb9dfd91554c6a54ced69a13420e22314f81fe752367748
SSDEEP 6144:4iucV6ntDwxp9x6EmioEmGX7TcUyixOKgMxMXiXr2XLBD85Py7Wfmld7a2g70qh7:4iuXtDKp9x6EmiUGX7TcUZHgMvWJL7Wr
TLSH
T16684D091F2C898E6F44343B14C36EA61112FBE5D5137491A3E2B7A39B9732436326DCB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2336	818bfda0ec36a0fa83624397b7af9eefb8cf6a22a021a790a3c6c9b743f6cf63.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	818bfda0ec36a0fa83624397b7af9eefb8cf6a22a021a790a3c6c9b743f6cf63.exe

C:\Users\Admin\AppData\Local\Temp\818bfda0ec36a0fa83624397b7af9eefb8cf6a22a021a790a3c6c9b743f6cf63.exe
"C:\Users\Admin\AppData\Local\Temp\818bfda0ec36a0fa83624397b7af9eefb8cf6a22a021a790a3c6c9b743f6cf63.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi242B.tmp\System.dll
Size 11KB
SHA256 852047023ba0cae91c7a43365878613cfb4e64e36ff98c460e113d5088d68ef5
MD5 be2621a78a13a56cf09e00dd98488360
SHA1 75f0539dc6af200a07cdb056cddddec595c6cfd2
SHA512 b80cf1f678e6885276b9a1bfd9227374b2eb9e38bb20446d52ebe2c3dba89764aa50cb4d49df51a974478f3364b5dbcbc5b4a16dc8f1123b40c89c01725be3d1
SSDEEP 192:eB2HS+ihg200uWz947Wzvxu6v0MI7JOde+Ij5Z77dslFsE+:3S62Gw947ExuGDI7J8EF7KIE
TLSH
T16A326B26535480F2F0A09079885B372B3B3A560166BA4ED7CFE7C5867E282E67D3C713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2336-9-0x0000000006150000-0x0000000007C85000-memory.dmp

Download

memory/2336-10-0x0000000006150000-0x0000000007C85000-memory.dmp