Analysis
- user interaction
yes - max time kernel
26s - max time network
27s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/04/2026, 11:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Odin3_v3.10.7/Odin3 v3.10.7.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Odin3_v3.10.7/Odin3.ini
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target Odin3_v3.10.7/Odin3 v3.10.7.exe
- Size 2.4MB
- Sample260418-nyd52agy3m
- SHA256 0edfea34eb688d867150075063fb2ee6ba074f5e69367b7759c509d248d7cd2c
- MD5 9f190df6e8a25bffa281b3649f0f03b8
- SHA1 36689f61959422e7902c25e112db8953cdccae75
- SHA512 81edfb76f5ac19fb401204087a6e79d7a23f5492ad8bb46c200727588bce63ad1b05b93e8933dcc81a3dfcf804894f72dfdf76a5665d87675a7da5a9fbba2d28
- SSDEEP 49152:gtve7GRpQILIZEkAxIpSEw4IYE9VyWgtsQcsTZZkt7K5FS:gtm7GRqIL2EvIpSEw4+IWgtsQcl
- TLSH T1F0B5AF2175B1806BD1730F33AA8D736DA2ADBD701B355297228B3E6C3E70481D939E67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Odin3 v3.10.7.exe - Modifies registry class 55 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" Odin3 v3.10.7.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Odin3 v3.10.7.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Odin3 v3.10.7.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Odin3 v3.10.7.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Odin3 v3.10.7.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Odin3 v3.10.7.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Odin3 v3.10.7.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 6c003100000000003e5c250410004f4e454e4f547e310000540009000400efbe3e5c25043e5c2a042e000000642902000000010000000000000000000000000000004b7f65004f006e0065004e006f007400650020004e006f007400650062006f006f006b007300000018000000 Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "2" Odin3 v3.10.7.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents" Odin3 v3.10.7.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} Odin3 v3.10.7.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Odin3 v3.10.7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Odin3 v3.10.7.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Odin3 v3.10.7.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" Odin3 v3.10.7.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Odin3 v3.10.7.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Odin3 v3.10.7.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Odin3 v3.10.7.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Odin3 v3.10.7.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" Odin3 v3.10.7.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" Odin3 v3.10.7.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Odin3 v3.10.7.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Odin3 v3.10.7.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" Odin3 v3.10.7.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Odin3 v3.10.7.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" Odin3 v3.10.7.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" Odin3 v3.10.7.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Odin3 v3.10.7.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" Odin3 v3.10.7.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Odin3 v3.10.7.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" Odin3 v3.10.7.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Odin3 v3.10.7.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" Odin3 v3.10.7.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Odin3 v3.10.7.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell Odin3 v3.10.7.exe Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" Odin3 v3.10.7.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings Odin3 v3.10.7.exe Set value (data) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 Odin3 v3.10.7.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" Odin3 v3.10.7.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Odin3 v3.10.7.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2540 Odin3 v3.10.7.exe 2540 Odin3 v3.10.7.exe 2540 Odin3 v3.10.7.exe 2540 Odin3 v3.10.7.exe 2540 Odin3 v3.10.7.exe 2540 Odin3 v3.10.7.exe 2540 Odin3 v3.10.7.exe 2540 Odin3 v3.10.7.exe