Overview
overview
7Static
static
7腾龙工�...om.url
windows10-2004-x64
1腾龙工�...om.url
windows11-21h2-x64
1App/ImageT...er.chm
windows10-2004-x64
1App/ImageT...er.chm
windows11-21h2-x64
1App/ImageT...er.exe
windows10-2004-x64
4App/ImageT...er.exe
windows11-21h2-x64
3App/ImageT...32.dll
windows10-2004-x64
3App/ImageT...32.dll
windows11-21h2-x64
3App/ImageT...pr.dll
windows10-2004-x64
3App/ImageT...pr.dll
windows11-21h2-x64
3App/ImageT...er.chm
windows10-2004-x64
1App/ImageT...er.chm
windows11-21h2-x64
1App/ImageT...er.exe
windows10-2004-x64
3App/ImageT...er.exe
windows11-21h2-x64
3App/ImageT...lc.exe
windows10-2004-x64
3App/ImageT...lc.exe
windows11-21h2-x64
3App/ImageT...64.dll
windows10-2004-x64
1App/ImageT...64.dll
windows11-21h2-x64
1App/ImageT...pr.dll
windows10-2004-x64
3App/ImageT...pr.dll
windows11-21h2-x64
3ImageTuner...le.exe
windows10-2004-x64
7ImageTuner...le.exe
windows11-21h2-x64
7$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows11-21h2-x64
3$PLUGINSDI...os.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows11-21h2-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/04/2026, 00:57
Behavioral task
behavioral1
Sample
腾龙工作室 - TenlonStudio.Com.url
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
腾龙工作室 - TenlonStudio.Com.url
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
App/ImageTuner32/ImageTuner.chm
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
App/ImageTuner32/ImageTuner.chm
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
App/ImageTuner32/ImageTuner.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
App/ImageTuner32/ImageTuner.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
App/ImageTuner32/ielib32.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
App/ImageTuner32/ielib32.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
App/ImageTuner32/itpr.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
App/ImageTuner32/itpr.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
App/ImageTuner64/ImageTuner.chm
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
App/ImageTuner64/ImageTuner.chm
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
App/ImageTuner64/ImageTuner.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
App/ImageTuner64/ImageTuner.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
App/ImageTuner64/balc.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
App/ImageTuner64/balc.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
App/ImageTuner64/ielib64.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
App/ImageTuner64/ielib64.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
App/ImageTuner64/itpr.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
App/ImageTuner64/itpr.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
ImageTunerPortable.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
ImageTunerPortable.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/UAC.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/execDos.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/execDos.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target App/ImageTuner64/balc.exe
- Size 91KB
- Sample260418-baxagset3s
- SHA256 f6a23ec46fa5d1371fe1ff85b1f976f59f2ae31877255abdae2df3022eaeb9a3
- MD5 953b2e40e33dc381b9bf4c7f35db50ef
- SHA1 a7170ced36c68b188a37fa76c7d7806efc7b291c
- SHA512 176061671f6dd60a632bb1945f23bbce3e0a22eac0b69ae05aa23e82b346f86460ef4a0b241faadf000e89d4b85bfb2bb1508ad147905e4e1576729af81752af
- SSDEEP 1536:5oLL8dOf8rTYeVsJ5qkMJQirvuEaoLF7Bu8A53bKXbUxUQ+8iAv:5oLL8dOfkjTrWoLF7A9RbKrUxLDv
- TLSH T1E5935B23BAD05533D064CBBD1C666FE5987FB9303922046B6EBCA94D0CE92C09D4E367
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language balc.exe - Modifies registry class 34 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\InprocServer32\ balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\InprocServer32\ = "C:\\Windows\\SysWOW64\\msvidctl.dll" balc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\Version balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\Version\ = "1.0" balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\TypeLib\ balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\ = "Kinolo Apilab Fanagbiza object" balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A14BAA3-ABC5-DFC8-FEC3-81C047EC027B}\ balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A14BAA3-ABC5-DFC8-FEC3-81C047EC027B}\1.0\ = "OLE DB Errors Type Library" balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A14BAA3-ABC5-DFC8-FEC3-81C047EC027B}\1.0\0\win32\ balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A14BAA3-ABC5-DFC8-FEC3-81C047EC027B}\1.0\0\win64\ balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\ProgID\ = "BDATuner.AnalogTVTuningSpace.1" balc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A14BAA3-ABC5-DFC8-FEC3-81C047EC027B}\1.0 balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A14BAA3-ABC5-DFC8-FEC3-81C047EC027B}\1.0\0\win32\ = "C:\\Program Files (x86)\\Common Files\\System\\Ole DB\\oledb32.dll\\2" balc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\TypeLib balc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\InprocServer32 balc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\Programmable balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A14BAA3-ABC5-DFC8-FEC3-81C047EC027B}\1.0\ balc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A14BAA3-ABC5-DFC8-FEC3-81C047EC027B}\1.0\0 balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\VersionIndependentProgID\ balc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\Implemented Categories balc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\ProgID balc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A14BAA3-ABC5-DFC8-FEC3-81C047EC027B}\1.0\0\win32 balc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A14BAA3-ABC5-DFC8-FEC3-81C047EC027B}\1.0\0\win64 balc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9} balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\Implemented Categories\ balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\ProgID\ balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\Programmable\ balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A14BAA3-ABC5-DFC8-FEC3-81C047EC027B}\1.0\0\ balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A14BAA3-ABC5-DFC8-FEC3-81C047EC027B}\1.0\0\win64\ = "C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll\\2" balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\Version\ balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\VersionIndependentProgID\ = "BDATuner.AnalogTVTuningSpace" balc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A14BAA3-ABC5-DFC8-FEC3-81C047EC027B} balc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\TypeLib\ = "{6A14BAA3-ABC5-DFC8-FEC3-81C047EC027B}" balc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{076D2840-0249-4D26-8DB9-CD8D2BA2C0D9}\VersionIndependentProgID balc.exe