2f24dcdd9485a4e6f39e6ddcd25981b9d6bc303f4c48b9b683f469c655a6b684

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uninstall.exe
Size 760KB
Sample261102-e5kfyszygy
SHA256 2f24dcdd9485a4e6f39e6ddcd25981b9d6bc303f4c48b9b683f469c655a6b684
MD5 03888f66e9806cecd18fc0c630849b1e
SHA1 0f2f7c95e863ca96acc17f04ff27c42a9be7556a
SHA512 9e2aa29b841db5bd72612e392c4e01c92473c7e881f3073cbd297b5eca7e7cdf22c3d18cc7b9a8c96de666b148306f44427ae5e9d8d9524cba582d39c1234834
SSDEEP 12288:vnPdU1QNTj1vClJNFGkyauGpFu3RdYcdUrsePR7pfXLTJgKlEalTXDsSLic8jXxq:fPdfCljFRrK3RdYeUrtNXLlp+aJXtd8I
TLSH
T1EBF423A4A634C453CD2777308D3A977A8F74AA65201D23071F60DF96ADAB9D00D387E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
892	Un.exe

Executes dropped EXE 1 IoCs

pid	Process
892	Un.exe

Loads dropped DLL 3 IoCs

pid	Process
892	Un.exe
892	Un.exe
892	Un.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Un.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
892	Un.exe
892	Un.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 892	4716	uninstall.exe	83

C:\Users\Admin\AppData\Local\Temp\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nscC9F4.tmp\LangDLL.dll
Size 5KB
SHA256 32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e
MD5 50016010fb0d8db2bc4cd258ceb43be5
SHA1 44ba95ee12e69da72478cf358c93533a9c7a01dc
SHA512 ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233
SSDEEP 48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL
TLSH
T113C18370F3D248B9C5D1413778A732D36612AE74A784504F9B6315AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nscC9F4.tmp\System.dll
Size 12KB
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nscC9F4.tmp\nsis_tauri_utils.dll
Size 1.1MB
SHA256 0eed48313a7f904d7cc1977b70000ab3f11f18cadc8e6a69b807d288ca71f9db
MD5 1e38f56aba852b737f2866c48b823165
SHA1 53a7cfaeb6a4a9653d6d5fbff02a3c3b8720130a
SHA512 5cbf6ca67aee29f5afbbaf57a72eb58e8f85b692e69aa5acd5817b00dc6948486189a8e74f4fcae302e9c453cc770eef78b3ffa70a914d911246e5b4992fc9a4
SSDEEP 24576:wSi9LsLAEnNUYZbeC4JwA9HU7Ncot2O/rBWDTRYQn652FOVE5TmcnlgVIH06iyQ:di9Y/W07NP/eTRPLD1n2IU6i3
TLSH
T1E545AD81FAC29AB1C94F1674105FE33BAB3558084756CFE3D7809E31F8673A25DA929C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Un.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe
Size 760KB
SHA256 2f24dcdd9485a4e6f39e6ddcd25981b9d6bc303f4c48b9b683f469c655a6b684
MD5 03888f66e9806cecd18fc0c630849b1e
SHA1 0f2f7c95e863ca96acc17f04ff27c42a9be7556a
SHA512 9e2aa29b841db5bd72612e392c4e01c92473c7e881f3073cbd297b5eca7e7cdf22c3d18cc7b9a8c96de666b148306f44427ae5e9d8d9524cba582d39c1234834
SSDEEP 12288:vnPdU1QNTj1vClJNFGkyauGpFu3RdYcdUrsePR7pfXLTJgKlEalTXDsSLic8jXxq:fPdfCljFRrK3RdYeUrtNXLlp+aJXtd8I
TLSH
T1EBF423A4A634C453CD2777308D3A977A8F74AA65201D23071F60DF96ADAB9D00D387E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download