25b7e99cf8c74799d813d0b1e2de6d146fcc12ddb03372711b2097a7e80cf004

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
patch_16.10.0.6093_16.10.0.6125.exe
Size 7.6MB
Sample261113-w2awsaez61
SHA256 25b7e99cf8c74799d813d0b1e2de6d146fcc12ddb03372711b2097a7e80cf004
MD5 2c8a14d231b8e835e5147185aad320c2
SHA1 bda08991e23e4b45dfce1d95c42c4ced9f04d44a
SHA512 3ca13d9be74af970cfa5c39b60fda9e72b2eb2fe42c0d6e76c85a0096a235264fdea6f16cb8cb42eb0e93f841c4ae350faf251cfd748e21e2b58958fb23bd5a7
SSDEEP 196608:7woJrDSxMI/HBIz+bbgomkqT63bGvDwTzEpPeZu+Kd:7KrhIz6VbSv46GI+Kd
TLSH
T169863381E2369194F1574FB294B2D0B04213BF561B39EA7F056CBB0D1A375EB81A3D3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4132	patchupdater.exe

Loads dropped DLL 3 IoCs

pid	Process
3396	patch_16.10.0.6093_16.10.0.6125.exe
3396	patch_16.10.0.6093_16.10.0.6125.exe
3396	patch_16.10.0.6093_16.10.0.6125.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patchupdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patch_16.10.0.6093_16.10.0.6125.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 4132	3396	patch_16.10.0.6093_16.10.0.6125.exe	90

C:\Users\Admin\AppData\Local\Temp\patch_16.10.0.6093_16.10.0.6125.exe
"C:\Users\Admin\AppData\Local\Temp\patch_16.10.0.6093_16.10.0.6125.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Users\Admin\AppData\Local\Temp\nsn7E3.tmp\patchupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\nsn7E3.tmp\patchupdater.exe" --action=install --oldhash=ce117275c27a8d308a6d4833ef81cfd8 --newhash=75a4a64f508a90c2a6843ad3f7b8f29a --oldv=16.10.0.6093 --newv=16.10.0.6125 --extra=""
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7E3.tmp\System.dll
Size 11KB
SHA256 93a8e95708882e56250ae55aef93417333b2dbe7ea99590abed34cdca2227e61
MD5 c51fc979c1c3e17bece7bd194aeb6ea2
SHA1 9a5d000d6393f2980062b4cc6e8f543493b1be8f
SHA512 716cdeb890307ff42901464dd24aa94e29415ef20d4e975c2733e34330fdf85edfd4ad9e00878edbe98921deebe44153279cb95acb309c5e1812026716dcdc4e
SSDEEP 192:sfer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4SyYXe:sw7Xws4FVWig86/5eCBqSyYXe
TLSH
T1B9322A3657A0D2F2D6A1827408A639336BBA762412B50D1BDFF74481FC15BC67E39327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn7E3.tmp\nsExec.dll
Size 6KB
SHA256 74e2c4b7905e3daa30a6d10d9e4de6b56316b965b4be068c4ed9017febd4613b
MD5 d7d0c9d3b5e38be79ce8765a9b492787
SHA1 27873370f5f3e88365612e0606247173a43eae60
SHA512 ed10326f8cf747b173c707fa3b4d0ef6c46492bda2eb712cf32a10544de0dd35a13a8cf1948e335df08fad418545be12a2d782fea5cefae453dafd578b53d36b
SSDEEP 96:/sspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIqf2:/2rjOELhySv5f2vvBjiAflaB1nIq
TLSH
T15CC108F656C005F3E40D04B93E31280F87FEE426073242769E9B1ECA19D2AB6FD68751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patchupdater.exe

Path C:\Users\Admin\AppData\Local\Temp\nsn7E3.tmp\patchupdater.exe
Size 3.0MB
SHA256 f2674f32026d0c39baa682493d9d4d0ba52884892ec6dc10653cf80a946489a9
MD5 8ce13a6140de9c71916453ea3472d802
SHA1 fc85dd4f3c4f7663f6c4a613b2fce9e8349cd223
SHA512 f200b7acce99f1dd4d02e892700af1c45f3337fc2c480a95172fd9ab6f76beb82161bd2d17128a9028cf069e5d819cd3aa1b4a291f46dba0e8effbfbca835473
SSDEEP 49152:yXp2ANrLAeWGWOMaGo6UD0H6iyJLwTB+7JdnTK+tPy4KDTCHr5bKTGp:yXpFNc7OMvs5iyJLwIT3A4KY
TLSH
T13AE5AF13F7425536F8B70279A9FE573E8C3CAA211328D4D3E3C4196E45A19E17A3B386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads