75ed1a9f5a3297a71b4493d080a2c42c98f897302cb4682c27b7a7c2d79f22ca

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NUSANTARA-LS_%5BDN%5D.exe
Size 47KB
Sample260930-ancbssxt2l
SHA256 75ed1a9f5a3297a71b4493d080a2c42c98f897302cb4682c27b7a7c2d79f22ca
MD5 9b54a8ba0c742dbdb40181b746b0bc5d
SHA1 155afbf31f7d6f2e4320e304bac3c17c4db6db91
SHA512 701d1b7f947b9e2d65b2535318242f2a7daef86bbe1dbe9cb996ac979ca17e0dbe9636a51b248eba85ac45ba1cbb2e7b10bd001bae8df76ad380e94ad406b0df
SSDEEP 768:Sej4mi1fLiwdLgLYBRRdk7tfxeOlQl0WG6/JaqVxB3BHsv97OX+JvrT:Vj4m+f/dLg0etbw7/Ja8xrUoX+Jv
TLSH
T1F2235B63BA4A8471D09402F1AC7A6BD787BFA8B10B1C93E7B3C6C9691A543D0FC7154E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
5	960	NUSANTARA-LS_%5BDN%5D.exe
8	960	NUSANTARA-LS_%5BDN%5D.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	NUSANTARA-LS_%5BDN%5D.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System\DxL.dll	NUSANTARA-LS_%5BDN%5D.exe
File created	C:\Windows\System\DC.DNK	NUSANTARA-LS_%5BDN%5D.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NUSANTARA-LS_%5BDN%5D.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NUSANTARA-LS_%5BDN%5D.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NUSANTARA-LS_%5BDN%5D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	NUSANTARA-LS_%5BDN%5D.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5244	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
960	NUSANTARA-LS_%5BDN%5D.exe
960	NUSANTARA-LS_%5BDN%5D.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 5244	960	NUSANTARA-LS_%5BDN%5D.exe	91

C:\Users\Admin\AppData\Local\Temp\NUSANTARA-LS_%5BDN%5D.exe
"C:\Users\Admin\AppData\Local\Temp\NUSANTARA-LS_%5BDN%5D.exe"
1⤵
- Downloads MZ/PE file
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\NCZ.log
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:5244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NCZ.log

Path C:\Users\Admin\AppData\Local\Temp\NCZ.log
Size 71B
SHA256 869d38c2845ecf475ab271144044e136fbd33fe6589260a1a56bd3ed40d7ce22
MD5 cb0d6f1447ce1ad8e5cc7c0b21ee222a
SHA1 f09c3d0d6a928e512785c86733a1562b75d8eeb4
SHA512 dd268e8c9e6fbd5fb21d07f0a98fc5d6d092e2a2600663f26f875ec8fada538281b6d521abe3f31e3308ea48c9897bffd2e89de2571e7e97212114f84aedf72c
TLSH
T1E9A00282FD04802399BDB5597ED7350172E28E52BD36FB872B512AC09566688DA8E019
MD5 SHA1 SHA512 TLSH

Submit Download