a4d56ceedcc7a24812e07ff15c34f72e1e402f9b90daaec575a878d3e04af2fa

Analysis

max time kernel
900s
max time network
465s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
azahar-windows-mxe-2126.2-installer.exe
Size 46.0MB
Sample261113-anmsjad13v
SHA256 a4d56ceedcc7a24812e07ff15c34f72e1e402f9b90daaec575a878d3e04af2fa
MD5 ce8d332dfba46b0f33d19d16d7204f19
SHA1 cb42aeec6ec97b3bc3f6ab0c4736e31eae1fea27
SHA512 0849e9d30387edfd1365d9649671fb2df857516d57e380b689652c3039347c185ad068989b50dc7ffd9cb20f0017a6cacbb7788503f37234d64815cb6e77f329
SSDEEP 786432:+PquHnb1QErJYCQzlZ4TKLC5ZiT+tpo94PEmoE39gXq/Ze0PrFqBxcWXY9cajzrO:9onb1ZKCw/4TK4G+g9GEmoRXuZe08Bxr
TLSH
T1BAB7336F8F51D2E5EE911B374165F23191B02D5A0E1A621C6BD23FE37B32B862532E07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
4792	azahar-windows-mxe-2126.2-installer.exe
4792	azahar-windows-mxe-2126.2-installer.exe
4792	azahar-windows-mxe-2126.2-installer.exe
4792	azahar-windows-mxe-2126.2-installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\azahar-windows-mxe-2126.2-installer.exe
"C:\Users\Admin\AppData\Local\Temp\azahar-windows-mxe-2126.2-installer.exe"
1⤵
- Loads dropped DLL
PID:4792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5220

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nszE7CD.tmp\LangDLL.dll
Size 8KB
SHA256 29550e1cc3b7f32762b19100b7562198f9ffc0e56ac98be260fed1c690d11504
MD5 0bd1ed77c095e9182be77acfa8667d5b
SHA1 1300d42c65b1fec8288ba18d95bbe7ff07445a83
SHA512 4a41040f183cd3de0b646cfc2ee467c050ae036b1237920eda7e87ae0b05cf3bfabee54c8dc319a028dd355f87d109b86f45036caadb1be125fda4fb04c48b27
SSDEEP 96:KrB4hEYJNrDnUA9E0DKvxam5qSDPTfPdAKe/Cdyyk7BdbXaH7bpHAg:mq+YJNrbUA8bqkDdAKeGkpg
TLSH
T14802C71E77900AFDD86AC236E9FBD761B572B0614736A60F1A2151222D31EB5383E149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nszE7CD.tmp\System.dll
Size 24KB
SHA256 f14fdfe7ee49dfea1fecfab6be7de22d96e7d5944dfa9a01fb4f2c4772f88452
MD5 5a73ed3cb049cf0dca1739c1b005b097
SHA1 2e32735b91b685417d367e5d608f78d47a9336b6
SHA512 701e697ac896bc352ad43e1b69094b1818a6dd3c13ea8dd1602dd13884d40260c4eaa9fd5c26d60f71e41d944fa72999fa3824ead94595ebb031294478460624
SSDEEP 384:sQCQz2kO6bb2U1b6D5umQ83o7ndleTm/qSq37rmQPCo9O1V:vCQzOWt6D3Q83oom/qXCQx9
TLSH
T19BB2190B73D248B9C46BC17981EB97F2AAB2BC501B35792F5034F1726F70D909B6E244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nszE7CD.tmp\UserInfo.dll
Size 7KB
SHA256 417cdcc0e5ff109973fb4fe61c0256147a8314c53965d2cdd14466a035f5edac
MD5 196ca1a2b1edcc7e6f82fcd507d60508
SHA1 7f541b911c9fe62b68515e829dff0c3e68856dbe
SHA512 55b4bf1073432d89902c05433927595aa951cbf88f6423123dfce914db043dbe53612da333af317609ffa0f7c1337cdb3de2ea456cccd66eb79b3530a3b7496b
SSDEEP 96:52PTowRBLRxpz2eXPdAKe/CdvrjIAurdbBBuxw/p:I7ow1Lq8PdAKekMw
TLSH
T1EDE1A54B736125A6C14AE2BD81EA5D22BCFB7C345A37620D880061663D30BE1F731B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nszE7CD.tmp\nsDialogs.dll
Size 14KB
SHA256 f2d63d9318ce097307d907795cb1913ea9fec32a49997ac52d2fef1d6492382e
MD5 cd04ff8e1ae3d3724554f8d04493f3b0
SHA1 6c4f50955edfa62770e7c10fab29b5db295b2c1d
SHA512 ae14129e1ed057aec4a84e4f2fa9e46c35e1ab05fe49bd9d291158da4d80a119eaf2a0e89f2670339cf7d0940182a556e3b5484d9f40016c3f8d313ac78b2d18
SSDEEP 192:emOWLlcwpumq4xQfXcXsBTKqnsfsSx04h6QE0Xe0dAKeGlYTZbleks8jTvitizdw:HOOcQ5xQ093fsYh9ndler1lhTvPzAl4
TLSH
T191521A0B3B9692A9CC1FE33CE5FF5B3162F370181525BB0E07699951FDD1660C939288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4792-10-0x00007FF82ECB9000-0x00007FF82ECBA000-memory.dmp

Download

memory/4792-15-0x00007FF82ECB0000-0x00007FF82ECBF000-memory.dmp

Download

memory/4792-14-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/4792-22-0x00007FF82D5F0000-0x00007FF82D5FD000-memory.dmp

Download

memory/4792-20-0x0000000140000000-0x0000000140253000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads