dd1fb0babead3e4cfc4f1c2b6da6e188ade41656cd991dd67ae9080244166896

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$0/uninstall.exe
Size 78KB
Sample261014-npys3styhs
SHA256 dd1fb0babead3e4cfc4f1c2b6da6e188ade41656cd991dd67ae9080244166896
MD5 44f90c8f57c78ff549af6ce114277f57
SHA1 ddf8b6eb49b804f9082b892a439d8bb297f88cae
SHA512 451072bd2ae46c724da08c6ae8ad44c0ad78d41d16ec17c781f4e155e9e9347583b725ec3597f15a71263931a825e689b4b95141f91652075d69d82b567e4df8
SSDEEP 1536:PEkjY1zy214Qay0DGkJ7qAELVigJpVjcpDCxH9TplS1N/RA2/DD:8kjAJ4dDGkJ+AI0mguH9TpAN/RX/H
TLSH
T16273D10737C098B7C7AA063105BBEBBEFBB7965111216F570B900F6F2A219839A1D15B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3884	Au_.exe

Loads dropped DLL 3 IoCs

pid	Process
3884	Au_.exe
3884	Au_.exe
3884	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral7/files/0x00070000000243ea-3.dat	nsis_installer_1

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3884	1032	uninstall.exe	86

C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm1573.tmp\InstallOptions.dll
Size 13KB
SHA256 551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
MD5 d765c492c21689e3d9d61634371fd861
SHA1 ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA512 9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
SSDEEP 192:9B6RvrfvOuJQDghBy/X7QKq3TLGciZJf0EzWzMnz6WoF1dBs:v6RrviWaX7eiZJ7nz6bB
TLSH
T14D525D61738488F3E786063E745237138BD926257CA15DE2C6330FCA6A2718D7EF6342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm1573.tmp\System.dll
Size 10KB
SHA256 802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
MD5 fe24766ba314f620d57d0cf7339103c0
SHA1 8641545f03f03ff07485d6ec4d7b41cbb898c269
SHA512 60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
SSDEEP 192:rO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1aMBgMO:yKAFERdlxhGRYUzqZaMB
TLSH
T18E226C5547A041F3DD60823C08973D272BA837148EA54ED3CFD314429E296A6BCBC336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsm1573.tmp\ioSpecial.ini
Size 568B
SHA256 4fd4e2c16e8077ea60434fcbc514c7cf70dd67b2d245987744d168aadc280a0c
MD5 c3dd7fb440ad00e69b149d149c058c14
SHA1 256d7cd74cef45274cdca215833167dc894c0de7
SHA512 38ce3dd00cfacf0aafcb285f443df45787731c4bf07de6e7271f3c1effc7c7c2d8280f4926dfcbbc134cfd3f1436edd81d200646131ab82e1455ec8275e4bcdc
TLSH
T1A6F08199C54D43550C6171466AFD76E5A3A01C348B6616B095358A0B874EEC6C8DD8C3
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsm1573.tmp\ioSpecial.ini
Size 613B
SHA256 e032b8a0a328329faf7f46e9cfd538b7284237d513e226779c7cc4378d5a0d73
MD5 cafebcbbef5b2de81c346dc3aaecf62f
SHA1 eac4c1bd89178f6f3d00c7612868c7b49f80a651
SHA512 f284f7941d48db5651e5a53a8c86e6593ea6fb732a23f203dad0656330521e4e34fd9efdbd18578850fd5e4463eb7e1eb2fb043c8e83d44bda61c2a09b456c8f
TLSH
T133F0DD95C05D83300C61711722BDB7D5E3B03C744F2225B054318607478ECDB8ADE8C2
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsm1573.tmp\ioSpecial.ini
Size 568B
SHA256 4f76e87c4f06639fa01b82b22019153eef52a1ac54e2adb6468bc2980c466b2d
MD5 3ef2b4bbe49535e7f95d6ff8501c5f1c
SHA1 98737711345f47b2f783892294f1fd71ceca4580
SHA512 8e7790f78e8c5730ce8510ecdeef2ca80a9a5f04920d23aaa05db2b2fd99e5f54cf7c5341970c2805f941d8abc48cc4b3a78405eb1c13fe307aae4568c509a33
TLSH
T176F02698C44D03250C2431466BFEB7E5A3A02D348F2216B081308A07874FEC6C8DECC3
MD5 SHA1 SHA512 TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsm1573.tmp\modern-wizard.bmp
Size 150KB
SHA256 614d5d54c44ca502b3f433f39a6729c11b7e6a6d60aedbc59092e91f35fb5a95
MD5 79233b82a7a8fdc258f223161eec8d5f
SHA1 b5b4a92eeb619bd426c8f4d9ede4a4f2e8ee85ed
SHA512 9d1e05d9cf3455b6ed03a25defcb3cede5800cd951a2050cb7cdeb1f0f869a93a08f3083d6c2548ab78391219623e93ac98c9644c8f966b9fca13af712607ab3
SSDEEP 384:QeH0fR9FDyy4pqeTbmd811S729+D9zUug+1Sp5xwocI5AK5G1/Zk3Ju8X:vQEy/eTbmd811S729YAu1k3TY/Zk3vX
TLSH
T13CE39364F096A5C4D828967DBE74BD2E00615DCB38E94E4F1B2E3DB403F36038595EAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Au_.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Size 78KB
SHA256 dd1fb0babead3e4cfc4f1c2b6da6e188ade41656cd991dd67ae9080244166896
MD5 44f90c8f57c78ff549af6ce114277f57
SHA1 ddf8b6eb49b804f9082b892a439d8bb297f88cae
SHA512 451072bd2ae46c724da08c6ae8ad44c0ad78d41d16ec17c781f4e155e9e9347583b725ec3597f15a71263931a825e689b4b95141f91652075d69d82b567e4df8
SSDEEP 1536:PEkjY1zy214Qay0DGkJ7qAELVigJpVjcpDCxH9TplS1N/RA2/DD:8kjAJ4dDGkJ+AI0mguH9TpAN/RX/H
TLSH
T16273D10737C098B7C7AA063105BBEBBEFBB7965111216F570B900F6F2A219839A1D15B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads