ee30c697426b28b5a804096183eb80e3b4a6167f54d47d832eb7b77b2703b761

Analysis

max time kernel
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Froststrap-windows-x64.exe
Size 17.1MB
Sample261006-vc4l5assft
SHA256 ee30c697426b28b5a804096183eb80e3b4a6167f54d47d832eb7b77b2703b761
MD5 5c174414c04903ca8e3e765aa44b1f2c
SHA1 4b7f0c6cd6bbfb119910d7ccd860fc0447663439
SHA512 8e2d15fe7ac9f65ad3531b8a8874099556029ae24f99c16b6fef3d4aa4c41df65629567eedc7bf6431b357cce5a1985ece0ca7985266900526f8776092afd811
SSDEEP 393216:eAVjJy5UjJGpsZJinIX0gLbPGJMYI5wZR/LOf:Lo5qeuGy0Oq4f
TLSH
T1D307336CF20A7496E212EFBD63A7B242CD044F21DB888D17E77A392474FA711191B7C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5708	Froststrap-windows-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Froststrap-windows-x64.exe

C:\Users\Admin\AppData\Local\Temp\Froststrap-windows-x64.exe
"C:\Users\Admin\AppData\Local\Temp\Froststrap-windows-x64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsoD08.tmp\nsDialogs.dll
Size 14KB
SHA256 2222fe1337f1bea92bd0859cb5fa19e838e0c08ba3346147cd881956bbbbfe50
MD5 e39cb978003fb67f11cf710fb6fc2088
SHA1 bcb131591fefac731621785b209d9cf43579a3c6
SHA512 564f00cb20c23adeecc607e00be20c488d037108fd1cb666e1d31f2cf0f2bd044c7acc566452043e3d7483d3402404c850a78afc24742a7eec760916511745f0
SSDEEP 384:+0dUl5kStC//1RRhUhiIklcCCCC7uv417:+cUXalRRkzCCCC7uvm
TLSH
T1C262B50DBE1189F5E571D23081DBEB3FC1A8556BD55F0E0AFF760A0C7857271A92EA02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5708-5-0x0000000000400000-0x0000000000517000-memory.dmp

Download

memory/5708-6-0x0000000073E90000-0x0000000073E9C000-memory.dmp