4c8d570ceddc85ad6a40ba635e9cc00de7a54a050d365b403d921e045f735492

Analysis

max time kernel
153s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MVS_STD_5.0.2_260728.exe
Size 457.8MB
Sample261009-p33jvsba84
SHA256 4c8d570ceddc85ad6a40ba635e9cc00de7a54a050d365b403d921e045f735492
MD5 362dd8cfe442486aa8bebc4ff144ca75
SHA1 707387e359a9346dc8193c15d04cc7555c6aca74
SHA512 3cdf585159e7a0d52b6025e9ee8a42427562ba59716d6e52d136c8e05d48d393c1f3cef86efa727f8ebdc4ad384cbe0158450c8a4b3c0bcf6725ce3b9cb0ed13
SSDEEP 12582912:s9sxf9NZZw1Sv7QarKx3EGmBgoWxs0xMtV:s+xf9XZzMHxUZaoSsMM
TLSH
T1583933033395A172E26200715E3AF3EA5935FC525B3282C77194BD6E09357E0EB3A66F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	MVS_STD_5.0.2_260728.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	MVS_STD_5.0.2_260728.exe

Loads dropped DLL 2 IoCs

pid	Process
4260	MVS_STD_5.0.2_260728.exe
4260	MVS_STD_5.0.2_260728.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MVS_STD_5.0.2_260728.exe

C:\Users\Admin\AppData\Local\Temp\MVS_STD_5.0.2_260728.exe
"C:\Users\Admin\AppData\Local\Temp\MVS_STD_5.0.2_260728.exe"
1⤵
- Maps connected drives based on registry
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdFDB0.tmp\System.dll
Size 11KB
SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 17ed1c86bd67e78ade4712be48a7d2bd
SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
TLSH
T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsduilib.dll

Path C:\Users\Admin\AppData\Local\Temp\nsdFDB0.tmp\nsduilib.dll
Size 753KB
SHA256 d2c07e9293a608a8d55243dd49d0a1118388d49567dbf567908ce866a60a0b7c
MD5 635052c1dd971db5d952bcaccec25046
SHA1 3df262aff040eda965c57df95404830bdff5cbf8
SHA512 03be1b420dd12d09ec30e964c7d4610f9028c7f8294ea1d3c1d5b4868914c10438656fa1b28841a95308dceace4d413e094f50c75b3e56896afff2b55256a3e8
SSDEEP 12288:5QlrWl7bAnqwhY4Vdr1WmvC0vNgiiKgZpZhaBByMwRWKZcq2QRK:5Q5m7bPwNWmvCENgiXgZpZYBoMQZY
TLSH
T1E5F47D2279818271F1A102B5947FFB2F18BEFD1523259AF7A2D81C1E0D346E36B34697
MD5 SHA1 SHA512 SSDEEP TLSH