4bff0923756b97f3d04de2d45e886076d77a6495d32e985b452a927d24f68323

Analysis

max time kernel
0s
max time network
6s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
D7MAS VIRUS MADE BY L2RF/RESALLES/D7MOSY VIRUS.exe
Size 923KB
Sample260924-ehqz8ade63
SHA256 4bff0923756b97f3d04de2d45e886076d77a6495d32e985b452a927d24f68323
MD5 7c32bef68c811c25b0da6d99a22ecebe
SHA1 3e7b0e068f5f05bc0ff0a561ddec9f57e0db8b5d
SHA512 4c9066dfec8259439c274ae506330f7843831fff1c331c2329128a83e12298799bee910d621759b4472ed737945b062257093f888904b6552bf0584887125fa1
SSDEEP 24576:cGBYWIyWQPdWfEHnWbLunWMYUaHzLY2ON7:NInQPdWfSnayzYUCY2a7
TLSH
T1CB151263A180887DD5B74D3380E2E930A37FB91252294D272394DE681F751D06EDBFBA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5876	TROLL5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TROLL5.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 5876	3300	D7MOSY VIRUS.exe	89

C:\Users\Admin\AppData\Local\Temp\D7MAS VIRUS MADE BY L2RF\RESALLES\D7MOSY VIRUS.exe
"C:\Users\Admin\AppData\Local\Temp\D7MAS VIRUS MADE BY L2RF\RESALLES\D7MOSY VIRUS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Users\Admin\AppData\Local\Temp\MasonDrop\TROLL5.exe
  "C:\Users\Admin\AppData\Local\Temp\MasonDrop\TROLL5.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5876
- C:\Users\Admin\AppData\Local\Temp\MasonDrop\MBR.exe
  "C:\Users\Admin\AppData\Local\Temp\MasonDrop\MBR.exe"
  2⤵
  PID:4284

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004E8
1⤵
PID:52

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MBR.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\MBR.exe
Size 93KB
SHA256 acddde9514e3b9d5c40b3d1750af5f4187c99f8987b027d6da44fb6bcf79b3ca
MD5 d2fc66cf781a2497fceb4041a93cc676
SHA1 480b1aa31b0b31fc0e0833afbba06533ab9a90ee
SHA512 6c4cb42f786301be7614d4cb0b32601fea151351b0877e2371632435eb2c54bd4cd04d6b23bf4f49017ccaf679331162aac7329a1ed2409e3c2e02d0326e3487
SSDEEP 1536:CmwoXyoci5SjY3SaRO7IPqifrJxdhGZCJjmGasWhQcdQ5/hO2oFaLJ:Tv5MYRIMPqiTJx+ZqreRQ5/hXoM9
TLSH
T10A936C43B5D28CB2E5B21D311875CAA15A2FB9214E348E6B6794137E1F340D09E36FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TROLL5.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\TROLL5.exe
Size 800KB
SHA256 8237e127fa112db6ae8e5f2e6bc50edd904f2429123d630f89a8d0f53d10c4d1
MD5 f0af0f0e76dc1c4dc7e2dbf67665ef33
SHA1 19b2148666572664a6bffd9b0a80807af712e35d
SHA512 14e9e24b1cc470e5aa80cddec0a4281f8bb651d810f2375ffa96b882f082529f907a7369511e9a0462bcb843fc0fbade7523a174c991849332eb37038b279392
SSDEEP 12288:JVOjBXoWAQHZ2OPBkQASVd5IfbJQWYzBVXqKWOF+LmguP/WMYZCubHKG91MiYwd:XGBYWIyWQPdWfEHnWbLunWMYUaHzLY2
TLSH
T1C90523738480661DD5BF8D33E0E2FC30B37EFA1792194C016394ED94669A25867CBBB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3300-20-0x00007FF6B9FE0000-0x00007FF6B9FEE000-memory.dmp

Download

memory/5876-9-0x0000000074652000-0x0000000074653000-memory.dmp

Download

memory/5876-16-0x0000000000F10000-0x0000000000FDE000-memory.dmp

Download

memory/5876-18-0x0000000006000000-0x00000000065BA000-memory.dmp

Download

memory/5876-19-0x0000000005B20000-0x0000000005BB2000-memory.dmp

Download

memory/5876-21-0x0000000005B10000-0x0000000005B1A000-memory.dmp

Download

memory/5876-22-0x0000000074640000-0x0000000074DFC000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads