f9a4525a27269be6b5cbc1b0788f65bfda1d22855c6d2fff9fa90d05343af327

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ImageTunerPortable.exe
Size 199KB
Sample260418-baxagset3s
SHA256 f9a4525a27269be6b5cbc1b0788f65bfda1d22855c6d2fff9fa90d05343af327
MD5 a00ca306549c3d2310f5d04a0400c8c8
SHA1 4ae6379444011c458ae1fb51d4d6ef5840a5d975
SHA512 ee1d6035889b183296c1c45d77e8131d20db964472506e3bb7fdc72e12e6ccd272825dd2656d58b417d7f80a43e40770269503b5110766e3a88caa699508a6dd
SSDEEP 3072:VqeqOYEUXPnLSeuKyjOEmLeANssUxRrzva5Xdb97o6c9jHtn16p8osnBV0mp0TLh:UEUXpy6zeBnRGb9+jNnQCLBVwB
TLSH
T1D514F142EBE5D07BF6B10FF12A768A418EB6FD2408749A5BA344DACD3C32195D92C707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3552	ImageTunerPortable.exe
3552	ImageTunerPortable.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ImageTunerPortable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	balc.exe

Modifies registry class 34 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{730BADF3-F8F5-4456-C4E9-FE565CE6D9A9}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\141.0.7340.0\\updater.exe\\6"	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\ = "Ravoteto Class"	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\InprocServer32\ = "C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\Interceptor.dll"	balc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{730BADF3-F8F5-4456-C4E9-FE565CE6D9A9}	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{730BADF3-F8F5-4456-C4E9-FE565CE6D9A9}\	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{730BADF3-F8F5-4456-C4E9-FE565CE6D9A9}\1.0\0\win32\	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\TypeLib\	balc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\Version	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\VersionIndependentProgID\	balc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\ProgID	balc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{730BADF3-F8F5-4456-C4E9-FE565CE6D9A9}\1.0\0\win32	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\TypeLib\ = "{730BADF3-F8F5-4456-C4E9-FE565CE6D9A9}"	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\Version\ = "1.0"	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\ProgID\	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\Programmable\	balc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{730BADF3-F8F5-4456-C4E9-FE565CE6D9A9}\1.0	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{730BADF3-F8F5-4456-C4E9-FE565CE6D9A9}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\141.0.7340.0\\updater.exe\\6"	balc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{730BADF3-F8F5-4456-C4E9-FE565CE6D9A9}\1.0\0\win64	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\Version\	balc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\VersionIndependentProgID	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{730BADF3-F8F5-4456-C4E9-FE565CE6D9A9}\1.0\	balc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\TypeLib	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\VersionIndependentProgID\ = "CommunicatorMeetingJoinAx.JoinManager"	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\ProgID\ = "CommunicatorMeetingJoinAx.JoinManager.2"	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{730BADF3-F8F5-4456-C4E9-FE565CE6D9A9}\1.0\ = "GoogleUpdater TypeLib for IAppBundleWeb"	balc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{730BADF3-F8F5-4456-C4E9-FE565CE6D9A9}\1.0\0	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{730BADF3-F8F5-4456-C4E9-FE565CE6D9A9}\1.0\0\	balc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}	balc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\Control	balc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\InprocServer32	balc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\Programmable	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{730BADF3-F8F5-4456-C4E9-FE565CE6D9A9}\1.0\0\win64\	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\Control\	balc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF2CB60-3D78-4640-EE98-5E5F3010F420}\InprocServer32\	balc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3552	ImageTunerPortable.exe
3552	ImageTunerPortable.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4228	ImageTuner.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4228	ImageTuner.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4228	ImageTuner.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 4228	3552	ImageTunerPortable.exe	78
PID 4228 wrote to memory of 5396	4228	ImageTuner.exe	79

C:\Users\Admin\AppData\Local\Temp\ImageTunerPortable.exe
"C:\Users\Admin\AppData\Local\Temp\ImageTunerPortable.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Users\Admin\AppData\Local\Temp\App\ImageTuner64\ImageTuner.exe
  "C:\Users\Admin\AppData\Local\Temp\App\ImageTuner64\ImageTuner.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Users\Admin\AppData\Local\Temp\App\ImageTuner64\balc.exe
    "C:\Users\Admin\AppData\Local\Temp\App\ImageTuner64\balc.exe" 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg898.tmp\System.dll
Size 11KB
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
TLSH
T1DC3229328B60C1F2D561C274496B3A3367B9761420B04D67DFB78446EC16AD66E3E327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.ini

Path C:\Users\Admin\AppData\Local\Temp\nsg898.tmp\launcher.ini
Size 940B
SHA256 9b3455fed83649394327baf6338e9224dcf0b4b4df4bf945f82fb65a821817f4
MD5 7d04d37089160e7f91f5a62e6b2f2bbb
SHA1 23f9f14ebac635b2718ed281f21f94509dcf564b
SHA512 a028b60a1f21239384461ccafad35c9b99bf56cc17707aa828dae6dde8a4b947ba6ff3205c6731705e42ced73c136cad539514532cfc7c7001401fb0f434784d
TLSH
T17611E10E5877E9B36E5369E439000B43E7DD884194DBEEDA24A2E70D19028BC35353D7
MD5 SHA1 SHA512 TLSH

Submit Download

registry.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg898.tmp\registry.dll
Size 29KB
SHA256 acb79c55b3b9c460d032a6f3aaf6c642bf8c1d450e23279d091cc0c6ca510973
MD5 2880bf3bbbc8dcaeb4367df8a30f01a8
SHA1 cb5c65eae4ae923514a67c95ada2d33b0c3f2118
SHA512 ca978702ce7aa04f8d9781a819a57974f9627e969138e23e81e0792ff8356037c300bb27a37a9b5c756220a7788a583c8e40cc23125bcbe48849561b159c4fa3
SSDEEP 768:HsKZwhFkGOr0Ga4+8DFFHR4mmw5+64fuKwX13:HLKmGOr0Ga4+8DFFHRrmw5+m
TLSH
T117D20980D64091A5E4F678FEB7D2633B462D6BB00553A09713F33E57AD68704BB2392E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imagetuner.ini

Path C:\Users\Admin\AppData\Roaming\Glorylogic\Image Tuner\imagetuner.ini
Size 37B
SHA256 6508602bbb08dd105ed9f3ea8a5c5bb9d382f3ed14ab0d3582663a88f7adc6d5
MD5 0b625eeadc5b5a4ebc9d8a435680c083
SHA1 ddaef294b2224a3ead319233c54c2f167bc96ea3
SHA512 7d42da9de53c9f4bcf7044b5aec80711b93d87511aff4a7e883ac5c7d13b3c03521aa2680f145395a42c887f5e58631e6d3fd98731b778c6a52226407c740b3a
MD5 SHA1 SHA512

Submit Download

memory/3552-43-0x0000000073FA4000-0x0000000073FA5000-memory.dmp

Download

memory/4228-44-0x0000000002E60000-0x0000000002E61000-memory.dmp

Download

memory/4228-60-0x0000000000400000-0x00000000010B3000-memory.dmp

Download

memory/4228-59-0x0000000002E60000-0x0000000002E61000-memory.dmp

Download

memory/5396-57-0x0000000003600000-0x0000000003601000-memory.dmp

Download

memory/5396-51-0x0000000002660000-0x0000000002661000-memory.dmp

Download

memory/5396-46-0x00000000023B0000-0x00000000024C7000-memory.dmp

Download

memory/5396-56-0x0000000003500000-0x0000000003501000-memory.dmp

Download

memory/5396-55-0x0000000003510000-0x0000000003511000-memory.dmp

Download

memory/5396-54-0x00000000025E0000-0x00000000025E1000-memory.dmp

Download

memory/5396-53-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/5396-52-0x0000000002620000-0x0000000002621000-memory.dmp

Download

memory/5396-50-0x00000000025F0000-0x00000000025F1000-memory.dmp

Download

memory/5396-49-0x0000000002600000-0x0000000002601000-memory.dmp

Download

memory/5396-58-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5396-47-0x00000000023B0000-0x00000000024C7000-memory.dmp

Download

memory/5396-48-0x0000000000A10000-0x0000000000A70000-memory.dmp

Download