Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
28/04/2026, 00:17
General
- Target KSpeak.Helper.exe
- Size 33.8MB
- Sample260428-algthaaz8w
- SHA256 5b3d8192914d8884bed6cf419ee805e0cc3825ea317c6965c62324183eb58e40
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\KSpeak.Helper.exe"C:\Users\Admin\AppData\Local\Temp\KSpeak.Helper.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\KSpeak\Helper\KSpeak.Helper.Core.exe"C:\Users\Admin\AppData\Local\KSpeak\Helper\KSpeak.Helper.Core.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
KSpeak.Helper.Core.exe
memory/1964-32-0x0000025B53B80000-0x0000025B53BA0000-memory.dmp
memory/1964-36-0x0000025B56BF0000-0x0000025B56C20000-memory.dmp
memory/1964-16-0x0000025B56AF0000-0x0000025B56BA0000-memory.dmp
memory/1964-12-0x0000025B52C10000-0x0000025B52C80000-memory.dmp
memory/1964-24-0x0000021ABDB20000-0x0000021ABDB60000-memory.dmp
memory/1964-28-0x0000025B52CC0000-0x0000025B52CE0000-memory.dmp
memory/1964-44-0x0000025B57140000-0x0000025B57190000-memory.dmp
memory/1964-64-0x0000025B57300000-0x0000025B57320000-memory.dmp
memory/1964-0-0x0000025B53BB0000-0x0000025B54840000-memory.dmp
memory/1964-52-0x0000025B56C60000-0x0000025B56C80000-memory.dmp
memory/1964-4-0x0000025B54D30000-0x0000025B54EE0000-memory.dmp
memory/1964-48-0x0000025B57270000-0x0000025B57300000-memory.dmp
memory/1964-40-0x0000025B56C20000-0x0000025B56C60000-memory.dmp
memory/1964-60-0x0000025B57350000-0x0000025B57380000-memory.dmp
memory/1964-56-0x0000025B57190000-0x0000025B571B0000-memory.dmp
memory/1964-20-0x0000025B56E80000-0x0000025B57080000-memory.dmp
memory/1964-70-0x0000025B574A0000-0x0000025B57530000-memory.dmp
memory/1964-78-0x0000025B575E0000-0x0000025B57600000-memory.dmp
memory/1964-74-0x0000025B57590000-0x0000025B575E0000-memory.dmp
memory/1964-8-0x0000021ABDAE0000-0x0000021ABDB20000-memory.dmp
memory/1964-93-0x0000021ABBF50000-0x0000021ABBF58000-memory.dmp
memory/1964-92-0x0000021ABC0B0000-0x0000021ABC251000-memory.dmp
memory/2132-94-0x000001FE7F3F0000-0x000001FE7F49C000-memory.dmp