d5d129a9d1046c6f3342636f1f1eb1e52b491db206cfe2e938e0cb008f6d16dc

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d5d129a9d1046c6f3342636f1f1eb1e52b491db206cfe2e938e0cb008f6d16dc.exe
Size 9.3MB
Sample261027-tykkpsft4q
SHA256 d5d129a9d1046c6f3342636f1f1eb1e52b491db206cfe2e938e0cb008f6d16dc
MD5 8264dac43a206e487932933555a9bdee
SHA1 c03fdb123ff9d2330ec799c5c3da88bbf747f7bd
SHA512 d48ca515af41a7247d68f52639c9c14d5e008df8d47410fddf334a9671004ec36d9b612afcb8f053743595874422a8ed6961585de01fddadae097d47038eed20
SSDEEP 196608:sfYcLfGR1AXF4XLjsvgDxJZBQq9cgyjZonmdynAnPxS/j26onMpEjJh2o:swyfGR1UF4XLjsYDDZGq9Tyt3gAnJSrY
TLSH
T12FA63384B8F4C3FFC77A423EC6E796846B6AD53298FD95961A000D58BE1EAC0D04F476
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4904	d5d129a9d1046c6f3342636f1f1eb1e52b491db206cfe2e938e0cb008f6d16dc.exe
4904	d5d129a9d1046c6f3342636f1f1eb1e52b491db206cfe2e938e0cb008f6d16dc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5d129a9d1046c6f3342636f1f1eb1e52b491db206cfe2e938e0cb008f6d16dc.exe

C:\Users\Admin\AppData\Local\Temp\d5d129a9d1046c6f3342636f1f1eb1e52b491db206cfe2e938e0cb008f6d16dc.exe
"C:\Users\Admin\AppData\Local\Temp\d5d129a9d1046c6f3342636f1f1eb1e52b491db206cfe2e938e0cb008f6d16dc.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf9D02.tmp\InstallOptions.dll
Size 15KB
SHA256 89dd7d646278d8bfc41d5446bdc348b9a9afaa832abf02c1396272bb7ac7262a
MD5 d1eefb07abc2577dfb92eb2e95a975e4
SHA1 0584c2b1807bc3bd10d4b60d2d23eeb0e6832ca2
SHA512 eaffd9940b1df59e95e2adb79b3b6415fff5bf196ebea5fe625a6c52e552a00b44d985a36a8dd9eb33eba2425ffea4244ed07a75d87284ff51ec9f9a5e1ac65e
SSDEEP 192:E6GQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT311929WtshLAzgSrX8:E6Nt+4t7uJalUnGesY7Lt8nC3/Yosa
TLSH
T186624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E4678565805D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsf9D02.tmp\ioSpecial.ini
Size 1KB
SHA256 3d346b60b54e4532ea6bd5ebd6f5d296befa168298431c03c9c1b4f74efc2d1f
MD5 8a1aec320785daada5396b307f7e1ad4
SHA1 40a6ba786b050d5b511638f5d44196ed3cee2a25
SHA512 e7fdb422bca1c67b0cbf41f6c15b122c04f7652eb2f54e4bc8fccd4cb0955d82619b80dd7db7c65b04e7ff56b8700077494d569b5df10dcb5413fc2d1a7e4c4e
TLSH
T18A21270B2DED0A25E36AFA58EBF0403993397855684DC50E80D10B0F44E9E81E427FEF
MD5 SHA1 SHA512 TLSH