Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
18/04/2026, 00:57
General
- Target App/ImageTuner64/ImageTuner.exe
- Size 10.9MB
- Sample260418-baxagset3s
- SHA256 e181de4290cd2b990b5d273af4d26f4e77d90ca46de3480b976f54c7c8e3c8ed
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 29 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\App\ImageTuner64\ImageTuner.exe"C:\Users\Admin\AppData\Local\Temp\App\ImageTuner64\ImageTuner.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\App\ImageTuner64\balc.exe"C:\Users\Admin\AppData\Local\Temp\App\ImageTuner64\balc.exe" 22⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4732-0-0x0000000001140000-0x0000000001141000-memory.dmp
memory/4732-36-0x0000000000400000-0x00000000010B3000-memory.dmp
memory/4732-34-0x0000000000400000-0x00000000010B3000-memory.dmp
memory/4732-35-0x0000000005C30000-0x0000000005C3C000-memory.dmp
memory/4732-33-0x0000000001140000-0x0000000001141000-memory.dmp
memory/4832-14-0x0000000003450000-0x0000000003451000-memory.dmp
memory/4832-12-0x0000000003450000-0x0000000003451000-memory.dmp
memory/4832-23-0x0000000003540000-0x0000000003541000-memory.dmp
memory/4832-22-0x0000000003540000-0x0000000003541000-memory.dmp
memory/4832-21-0x0000000003540000-0x0000000003541000-memory.dmp
memory/4832-20-0x0000000003540000-0x0000000003541000-memory.dmp
memory/4832-19-0x0000000003540000-0x0000000003541000-memory.dmp
memory/4832-18-0x0000000003440000-0x0000000003441000-memory.dmp
memory/4832-17-0x0000000003450000-0x0000000003451000-memory.dmp
memory/4832-16-0x0000000003450000-0x0000000003451000-memory.dmp
memory/4832-15-0x0000000003450000-0x0000000003451000-memory.dmp
memory/4832-26-0x0000000003440000-0x0000000003441000-memory.dmp
memory/4832-13-0x0000000003450000-0x0000000003451000-memory.dmp
memory/4832-24-0x0000000003540000-0x0000000003541000-memory.dmp
memory/4832-11-0x0000000003450000-0x0000000003451000-memory.dmp
memory/4832-10-0x0000000003450000-0x0000000003451000-memory.dmp
memory/4832-9-0x0000000002520000-0x0000000002521000-memory.dmp
memory/4832-8-0x0000000002570000-0x0000000002571000-memory.dmp
memory/4832-7-0x0000000002560000-0x0000000002561000-memory.dmp
memory/4832-6-0x00000000025A0000-0x00000000025A1000-memory.dmp
memory/4832-5-0x0000000002530000-0x0000000002531000-memory.dmp
memory/4832-4-0x0000000002540000-0x0000000002541000-memory.dmp
memory/4832-27-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4832-25-0x0000000003440000-0x0000000003441000-memory.dmp
memory/4832-2-0x0000000002200000-0x0000000002317000-memory.dmp
memory/4832-3-0x0000000002320000-0x0000000002380000-memory.dmp
memory/4832-1-0x0000000002200000-0x0000000002317000-memory.dmp