9bcaa62be62b427c06769006200208264217c0957b3ac4f150f687fcfd29155e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/11/2026, 01:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/NScurl.dll
Size 7.4MB
Sample261105-bztkwsst5l
SHA256 9bcaa62be62b427c06769006200208264217c0957b3ac4f150f687fcfd29155e
MD5 db425209aa38a6f6d8379f441b99950d
SHA1 951baa838310b9352dc9f8923ea7ada206efab94
SHA512 dd96e9ffb4c38bb3826ea0c178b9bfd71d38ce6d9f1887d3262c4ea8313049d2ba7b9a5279980d8981b8cc49929801e02ccd5fe48dffe7a787e9cff658592741
SSDEEP 196608:gfb4qtMPEdoSlT5x4Ww4EbEEW7IDqlcT1VuDx7Kk/fcHLKoW:WqLK
TLSH
T1A1764A94FECB04F1E55784B0D8EBB37F8B34A7118125D6BAEE0C1E56F933701261A61A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 3928	3948	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NScurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NScurl.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads