05dea167ce6069741f710f8edf3aff937a8b7f988a70626d8805bccb34b09c98

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 11:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dotmd-0.3.0-windows-arm64-installer.exe
Size 5.4MB
Sample261110-n2e7haxt2m
SHA256 05dea167ce6069741f710f8edf3aff937a8b7f988a70626d8805bccb34b09c98
MD5 1bd7237777c54c3fec05d69164c13c2e
SHA1 a357acc9543d91b33d38c12e2649945ff67138db
SHA512 e2174fdaba6f488844bcbc10c8c6a21ce7f5b8458fd13fb989a3210bafa6fdb5107746440c9a5fd7d50dba976142f4bd783c5cb7559f45ab2eb7396df892e2d9
SSDEEP 98304:i7UdoocaFQVCzSpasCGJ8VbiVsLkdo2xWRU9T+VbXt/9SdJQgFSFhO/3uUGuvZ:i70yAyMGJ8VbiqodfxQUp+RH2JfSFhid
TLSH
T1E9463318E9594EF5E63898F13AB2FD6A05349C0041BD3FCA6587177AEC7ACFAD4710A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2780	dotmd-0.3.0-windows-arm64-installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotmd-0.3.0-windows-arm64-installer.exe

C:\Users\Admin\AppData\Local\Temp\dotmd-0.3.0-windows-arm64-installer.exe
"C:\Users\Admin\AppData\Local\Temp\dotmd-0.3.0-windows-arm64-installer.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg7789.tmp\System.dll
Size 28KB
SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
MD5 81e34f1c4b04a15dbce200c52f598f67
SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
TLSH
T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2780-4-0x0000000074809000-0x000000007480A000-memory.dmp

Download

memory/2780-6-0x0000000000400000-0x000000000045D000-memory.dmp