Overview
overview
8Static
static
5Download More.url
windows11-21h2-x64
1FiX/MediaM...ne.exe
windows11-21h2-x64
3Join Teleg...re.url
windows11-21h2-x64
1Keygen-BTCR.rar
windows11-21h2-x64
1BTCR/keygen.exe
windows11-21h2-x64
5out.exe
windows11-21h2-x64
3btcr.nfo
windows11-21h2-x64
1file_id.diz
windows11-21h2-x64
3MediaMonke...13.exe
windows11-21h2-x64
8Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
21/04/2026, 01:45
Behavioral task
behavioral1
Sample
Download More.url
Resource
win11-20260130-en
Behavioral task
behavioral2
Sample
FiX/MediaMonkeyEngine.exe
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
Join Telegram for more.url
Resource
win11-20260130-en
Behavioral task
behavioral4
Sample
Keygen-BTCR.rar
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
BTCR/keygen.exe
Resource
win11-20260130-en
Behavioral task
behavioral6
Sample
out.exe
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
btcr.nfo
Resource
win11-20260130-en
Behavioral task
behavioral8
Sample
file_id.diz
Resource
win11-20260130-en
Behavioral task
behavioral9
Sample
MediaMonkey_2024.2.1.3213.exe
Resource
win11-20260130-en
General
- Target out.exe
- Size 12.7MB
- Sample260421-b6xk5aax21
- SHA256 433ef5628da4ea8018a46caaea542ff98eafa213b254c083a1564b50e4f7e040
- MD5 d03e4c3a9aee67b9174f232d5213abc7
- SHA1 bcd8fd1b6d825d3f20b1efa27181e86420ccdc26
- SHA512 e0e544e4b078b9239fef0e311b5ff3db67cd248b448ffe8dc4db896b5a30dddfc4480e686c2bd20112a45315ffc20956daea808cd2ec5608af4f749e881d91a1
- SSDEEP 98304:qxoZkhdva5rRIoX9XR5GILjR7VEIrnX3ZrDWXeT5wpDmrYCdP0wRalZLCwpokCFn:IocdVeDxrDYDd8P
- TLSH T1A0D6E723F2609E35C0DE4739549F47214332811B4F97A78702E499BDBD892A26FB678F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 3656 3400 WerFault.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\out.exe"C:\Users\Admin\AppData\Local\Temp\out.exe"1⤵PID:3400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 82⤵
- Program crash
PID:3656
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3400 -ip 34001⤵PID:2316