dd1fb0babead3e4cfc4f1c2b6da6e188ade41656cd991dd67ae9080244166896

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$0/uninstall.exe
Size 78KB
Sample261014-npys3styhs
SHA256 dd1fb0babead3e4cfc4f1c2b6da6e188ade41656cd991dd67ae9080244166896
MD5 44f90c8f57c78ff549af6ce114277f57
SHA1 ddf8b6eb49b804f9082b892a439d8bb297f88cae
SHA512 451072bd2ae46c724da08c6ae8ad44c0ad78d41d16ec17c781f4e155e9e9347583b725ec3597f15a71263931a825e689b4b95141f91652075d69d82b567e4df8
SSDEEP 1536:PEkjY1zy214Qay0DGkJ7qAELVigJpVjcpDCxH9TplS1N/RA2/DD:8kjAJ4dDGkJ+AI0mguH9TpAN/RX/H
TLSH
T16273D10737C098B7C7AA063105BBEBBEFBB7965111216F570B900F6F2A219839A1D15B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5676	Au_.exe

Loads dropped DLL 3 IoCs

pid	Process
5676	Au_.exe
5676	Au_.exe
5676	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral8/files/0x000d00000001c4ca-0.dat	nsis_installer_1

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 5676	4256	uninstall.exe	89

C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nslEB18.tmp\InstallOptions.dll
Size 13KB
SHA256 551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
MD5 d765c492c21689e3d9d61634371fd861
SHA1 ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA512 9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
SSDEEP 192:9B6RvrfvOuJQDghBy/X7QKq3TLGciZJf0EzWzMnz6WoF1dBs:v6RrviWaX7eiZJ7nz6bB
TLSH
T14D525D61738488F3E786063E745237138BD926257CA15DE2C6330FCA6A2718D7EF6342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nslEB18.tmp\System.dll
Size 10KB
SHA256 802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
MD5 fe24766ba314f620d57d0cf7339103c0
SHA1 8641545f03f03ff07485d6ec4d7b41cbb898c269
SHA512 60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
SSDEEP 192:rO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1aMBgMO:yKAFERdlxhGRYUzqZaMB
TLSH
T18E226C5547A041F3DD60823C08973D272BA837148EA54ED3CFD314429E296A6BCBC336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nslEB18.tmp\ioSpecial.ini
Size 568B
SHA256 f8d0d8ee1a7824538effacd45d94637980362668d946355bcc91bab559784acb
MD5 9d5a5e6ad89e68749a383cce8a5a49a3
SHA1 8ed2e97983a1fe4b71ba319db10707083b444ce6
SHA512 a0ea09a7f68582c9c29270cb4f1b1f45fa32b5d2851151919e4324eba90fe06eac067ce62706eba5236cd0a74a71dc834dd1210902015d329fd2bfe6681a0329
TLSH
T17FF08198C44D03661C6171476BFDB7D593A01C34CB1616B085318A078B4EEC6C8DDDC2
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nslEB18.tmp\ioSpecial.ini
Size 613B
SHA256 15e5a5c7ace542e51b146704999ecced321fc505f9ca7b7475822b339f59a95b
MD5 dafbca7421c765c04f29e3e35be54c03
SHA1 0322e781adf4bfadbaafb926be628a78c0f73949
SHA512 d2d327e2d6951f9a37955253cf4c65abc14e99cd2e29305544cf54db8e064aaa4147afda6840163578318ea3190e5733c5a138a4d4aea43d21011104ecbe22b6
TLSH
T18BF0DD94C05D43300C61711B26ADB7D5E3B02C744F2225B044318607478ECCB8ADECC2
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nslEB18.tmp\ioSpecial.ini
Size 652B
SHA256 1b8584f0f2dbf876e564393bdfa7174ffa0e9c185f91f08338d8513a0de885f9
MD5 6aa650227e85671251dd37257b859db6
SHA1 3cdfba3527f8a30fd86ea820adbc8b6c4cd9a9e2
SHA512 9a6660e379020102f8cc0a63aded73827d4c2c54f521bc960cf6b708a2cc45e71286375f77da42b01216d160e41663d2798f5223a2db43ff41ba03b21db3acd2
TLSH
T15CF09E94D05D43310C65711726ADB7D5B3B02C748A2219B0847185074B8ECD7C6DEDC2
MD5 SHA1 SHA512 TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nslEB18.tmp\modern-wizard.bmp
Size 150KB
SHA256 614d5d54c44ca502b3f433f39a6729c11b7e6a6d60aedbc59092e91f35fb5a95
MD5 79233b82a7a8fdc258f223161eec8d5f
SHA1 b5b4a92eeb619bd426c8f4d9ede4a4f2e8ee85ed
SHA512 9d1e05d9cf3455b6ed03a25defcb3cede5800cd951a2050cb7cdeb1f0f869a93a08f3083d6c2548ab78391219623e93ac98c9644c8f966b9fca13af712607ab3
SSDEEP 384:QeH0fR9FDyy4pqeTbmd811S729+D9zUug+1Sp5xwocI5AK5G1/Zk3Ju8X:vQEy/eTbmd811S729YAu1k3TY/Zk3vX
TLSH
T13CE39364F096A5C4D828967DBE74BD2E00615DCB38E94E4F1B2E3DB403F36038595EAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Au_.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Size 78KB
SHA256 dd1fb0babead3e4cfc4f1c2b6da6e188ade41656cd991dd67ae9080244166896
MD5 44f90c8f57c78ff549af6ce114277f57
SHA1 ddf8b6eb49b804f9082b892a439d8bb297f88cae
SHA512 451072bd2ae46c724da08c6ae8ad44c0ad78d41d16ec17c781f4e155e9e9347583b725ec3597f15a71263931a825e689b4b95141f91652075d69d82b567e4df8
SSDEEP 1536:PEkjY1zy214Qay0DGkJ7qAELVigJpVjcpDCxH9TplS1N/RA2/DD:8kjAJ4dDGkJ+AI0mguH9TpAN/RX/H
TLSH
T16273D10737C098B7C7AA063105BBEBBEFBB7965111216F570B900F6F2A219839A1D15B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads