bad113335da7f608ef20eacbd4c0d3f8a57eeab092263f01a256e785ce089948

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/11/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Volt\uninstall.exe
Size 77KB
Sample261107-mar7bact3r
SHA256 bad113335da7f608ef20eacbd4c0d3f8a57eeab092263f01a256e785ce089948
MD5 97cf23ea89caf74d69dba375d58a7aa1
SHA1 ddc8b72275d220c4f97d7b8ae5e594577eab0b33
SHA512 3a325e35f7636dd008b5d4f6d7c1df68f4828f49566eee260d5e40cb800542bc5b7343eee9a59992b2884347ff0a1e37ecf7b4f8c2e62842f98d3c9bb83fd828
SSDEEP 1536:krX4tpfcUjrwLxZYE8ksuOgdLeAyNx0HocAmviVqH3Kn9y4C:+X47fcIrwR8ksuOceABHzvoqHYU4C
TLSH
T18D73DF0467E0C8B3D67207311E7B5B776FF9A42212A89B1B1700579E7D72A81EE0E363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1844	Un.exe

Executes dropped EXE 1 IoCs

pid	Process
1844	Un.exe

Loads dropped DLL 15 IoCs

pid	Process
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Un.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe
1844	Un.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1844	1876	uninstall.exe	80

C:\Users\Admin\AppData\Local\Temp\Volt\uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\Volt\uninstall.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe" _?=C:\Users\Admin\AppData\Local\Temp\Volt\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaB7C4.tmp\LangDLL.dll
Size 5KB
SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
MD5 4b8a750993567ac9a350ba9768fabfa0
SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
TLSH
T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaB7C4.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsaB7C4.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Un.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe
Size 77KB
SHA256 bad113335da7f608ef20eacbd4c0d3f8a57eeab092263f01a256e785ce089948
MD5 97cf23ea89caf74d69dba375d58a7aa1
SHA1 ddc8b72275d220c4f97d7b8ae5e594577eab0b33
SHA512 3a325e35f7636dd008b5d4f6d7c1df68f4828f49566eee260d5e40cb800542bc5b7343eee9a59992b2884347ff0a1e37ecf7b4f8c2e62842f98d3c9bb83fd828
SSDEEP 1536:krX4tpfcUjrwLxZYE8ksuOgdLeAyNx0HocAmviVqH3Kn9y4C:+X47fcIrwR8ksuOceABHzvoqHYU4C
TLSH
T18D73DF0467E0C8B3D67207311E7B5B776FF9A42212A89B1B1700579E7D72A81EE0E363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download