7bca47068b83b5a49e55b839893f93e75b00544e0d3186464367b6281373d760

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dotmd-0.2.0-windows-arm64-installer.exe
Size 5.4MB
Sample261110-n2bjbasxfw
SHA256 7bca47068b83b5a49e55b839893f93e75b00544e0d3186464367b6281373d760
MD5 aebdfcac1e3b75d1587741c81eae95b9
SHA1 6ca755c4d2593586fbf2982d4c61e71239cde71b
SHA512 3c4ed1f473d6a61fa9495772f41406480e8311e49c6cb40c4ae75870ac540b7e2031c4db20ffcc4552b38aef3b25234cfa5ceec0e52449ae5451557582200d5e
SSDEEP 98304:x7UdoocaFQVCzSpasCG48jGDVwJW0eJ2VSZF6okv7lUGFeBJstJilnz+cZi//8VA:x70yAyMG48V7Vatk5UXRz+x//k5FTjQ
TLSH
T1D346333CDB6244F9C2364EF58DEAF90F427C6C0400A6364A9A971627DF378BB9A7D504
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1392	dotmd-0.2.0-windows-arm64-installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotmd-0.2.0-windows-arm64-installer.exe

C:\Users\Admin\AppData\Local\Temp\dotmd-0.2.0-windows-arm64-installer.exe
"C:\Users\Admin\AppData\Local\Temp\dotmd-0.2.0-windows-arm64-installer.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyB1B3.tmp\System.dll
Size 28KB
SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
MD5 81e34f1c4b04a15dbce200c52f598f67
SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
TLSH
T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1392-4-0x00000000744E9000-0x00000000744EA000-memory.dmp

Download

memory/1392-6-0x0000000000400000-0x000000000045D000-memory.dmp