2163be7094566c80ea69bd7705aa11437fcfb358f3bd2534c1fea06d5b069ac4

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DT NAmacro.exe
Size 657KB
Sample261029-wtq8ssss3k
SHA256 2163be7094566c80ea69bd7705aa11437fcfb358f3bd2534c1fea06d5b069ac4
MD5 d4d00d52681e5475616818fbca12a0d1
SHA1 9365f9f13ca62ef4f0c49ea0c870cf4ba0c4ca21
SHA512 cafa3d7c40766fd0ba45862c43ab39560095f5a928b1175d7d2218d179b63540b4fcd9edd89ce4b227a736fe4b27cb358c03afc8880b36d2dfe14a809fc40275
SSDEEP 12288:EgyBTANERKBWoW+4NU+jgauulTNrep8akndjbmpuxs0hpmS0Mg/6cnRzSgdF:HyB0NEUWoWzNUjuHrgidHMehpC/fRzS
TLSH
T106E40224227C067ACB7C8BBC58708690537C291FB56EDB5D36613CDCEAD2BE30654A93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	DT NAmacro.exe
File opened (read-only)	\??\O:	DT NAmacro.exe
File opened (read-only)	\??\S:	DT NAmacro.exe
File opened (read-only)	\??\U:	DT NAmacro.exe
File opened (read-only)	\??\V:	DT NAmacro.exe
File opened (read-only)	\??\Y:	DT NAmacro.exe
File opened (read-only)	\??\A:	DT NAmacro.exe
File opened (read-only)	\??\I:	DT NAmacro.exe
File opened (read-only)	\??\J:	DT NAmacro.exe
File opened (read-only)	\??\L:	DT NAmacro.exe
File opened (read-only)	\??\M:	DT NAmacro.exe
File opened (read-only)	\??\P:	DT NAmacro.exe
File opened (read-only)	\??\Z:	DT NAmacro.exe
File opened (read-only)	\??\N:	DT NAmacro.exe
File opened (read-only)	\??\Q:	DT NAmacro.exe
File opened (read-only)	\??\B:	DT NAmacro.exe
File opened (read-only)	\??\E:	DT NAmacro.exe
File opened (read-only)	\??\R:	DT NAmacro.exe
File opened (read-only)	\??\T:	DT NAmacro.exe
File opened (read-only)	\??\W:	DT NAmacro.exe
File opened (read-only)	\??\X:	DT NAmacro.exe
File opened (read-only)	\??\G:	DT NAmacro.exe
File opened (read-only)	\??\H:	DT NAmacro.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DT NAmacro.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DT NAmacro.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DT NAmacro.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4812	DT NAmacro.exe
Token: SeCreatePagefilePrivilege	4812	DT NAmacro.exe

C:\Users\Admin\AppData\Local\Temp\DT NAmacro.exe
"C:\Users\Admin\AppData\Local\Temp\DT NAmacro.exe"
1⤵
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4812-14-0x00000000086F0000-0x00000000087B2000-memory.dmp

Download

memory/4812-2-0x00000000063F0000-0x00000000063F8000-memory.dmp

Download

memory/4812-3-0x0000000006440000-0x0000000006478000-memory.dmp

Download

memory/4812-6-0x0000000008540000-0x000000000854E000-memory.dmp

Download

memory/4812-1-0x00000000058E0000-0x00000000058F0000-memory.dmp

Download

memory/4812-0-0x0000000000CC0000-0x0000000000D6A000-memory.dmp

Download

memory/4812-15-0x00000000058E0000-0x00000000058F0000-memory.dmp

Download

memory/4812-16-0x000000000C750000-0x000000000C7A0000-memory.dmp

Download

memory/4812-23-0x00000000058E0000-0x00000000058F0000-memory.dmp

Download

memory/4812-24-0x00000000058E0000-0x00000000058F0000-memory.dmp

Download

memory/4812-25-0x00000000058E0000-0x00000000058F0000-memory.dmp

Download

memory/4812-26-0x00000000058E0000-0x00000000058F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads