Analysis
- user interaction
yes - max time kernel
149s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/05/2026, 03:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ultimate-teto-night.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ultimate-teto-night.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target ultimate-teto-night.exe
- Size 351.4MB
- Sample260503-dv2f2saz5x
- SHA256 77e69f7ff61c0956a971491925c64ef63a2fe0380a2d64146a75396c621de73b
- MD5 d59ee9902e0217ec06c04124b3596d40
- SHA1 c76bbbc879283c9971ef0d9411c68c299cc19678
- SHA512 dd959d45fc8f35889bbe039d0d29880d751a011d63af07b973cf5729b215105dd384514821f0d47a56abeb53160b13b5e07c2c4a54e702ccef436c7a1dd6593b
- SSDEEP 6291456:dMGDWJuXrGrHjfLen9f08ei1iH/Ro33m7KavhQ/RGjfepKqchBCa3pISIo/VsH:dMGDWOgHjDe9f0xH/q3aB5qRGjfJqc+9
- TLSH T1C3092361D7D5D415E160743E82737A3B527E8DC83F175A06C2227E3A7E37BA82E52382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 3384 ultimate-teto-night.exe 3384 ultimate-teto-night.exe 3384 ultimate-teto-night.exe 3384 ultimate-teto-night.exe 3384 ultimate-teto-night.exe 3384 ultimate-teto-night.exe 3384 ultimate-teto-night.exe 3384 ultimate-teto-night.exe 3384 ultimate-teto-night.exe 3384 ultimate-teto-night.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ultimate-teto-night.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3384 ultimate-teto-night.exe 3384 ultimate-teto-night.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\mrt5270.tmp\Layer.mfx
- Size 122KB
- SHA256 9e9d49c81e02cdef2ea10f53fee958bb750a96e7567d680f86202f0e28e267a8
- MD5 8bba7602e13f66901207e4d7bdc99ff2
- SHA1 7efda2baa3eee70df450110bb89d934417bec3e1
- SHA512 7f31819c1ac931ff51df57b1ee0bad9a6d22c97c0e0bd6fdfc1bcec990f1c581773e90b3af609c734f9248736fa663136573298c9e0c5873307180cd2b9beb20
- SSDEEP 1536:NaGgvf+Q3Mmx0FnYGRPpnNm6prmICndZac8VkRyvsWjcdV+8OfDh+eOsadq:NaGgHf3i/nmICdZueV+vfDh/OtE
- TLSH T131C34A1176E19032E4E317325D786A520ABEBD22FB75DACBA34C014D5DB03C19B39BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt5270.tmp\cctrans.dll
- Size 347KB
- SHA256 9b834b5d26983451ef3a11c8c2a715724daa188fbd28597081ecb1e9ed672f87
- MD5 21e093d52a3afe8ed5532fcaa189c067
- SHA1 8aa7bcb26e3064cd4d1172090ff00d083ee19cc4
- SHA512 b4c2205c234e8ed4973fca9c64c0ec11753eb200c1d2eb3c66b9f4509426c8774f14ae1271583e0eaff268eae9c8375c5993af107e4db8d7c87b817bd1ccd9e8
- SSDEEP 6144:diAs8FRxWGjVbzWKCc/IEqibsBVthDU6Uthoy28TZKmpEGB:diAsmRgGJzWKCUIhUsjBhP9GB
- TLSH T11F748E10B9808031C2B7383416BDE6B21DBCA8301F749ADF9B581A7A5F745D1AB37A5F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt5270.tmp\kcini.mfx
- Size 330KB
- SHA256 5af175ffb932fb653873dad095dd40f2ab8d3fb56f287213c21bb68652ddad2d
- MD5 a6ad14845999c5aa7adf2911671a7c5b
- SHA1 98dfd5a9584d1c1b330c2c104c1779bd55ded211
- SHA512 32bb59826b82d47ec420ac2532e1387a85422d2f0ce5370ad2c95b914a7615d3b122dbf4dd045105eb8ffea49324dac57659f0e5f2500b4d0eb75047cb36dfd8
- SSDEEP 6144:K3gRipIs36PvsSufsm7Sna98p8r2jaeAfSfIaC4MeTkC3O:KlIs3s0SuR7SnaepwjKgH4M6k+O
- TLSH T160748E20B9C18032C67B35704979EAF11DBDA8201B345ADBA3AC097A5F744D2FE3596F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt5270.tmp\mmf2d3d11.dll
- Size 541KB
- SHA256 5f6563d6bf2f3ceab8b2ca2c15ba4f7fe882a82c1f72b10041b5692c6515a53a
- MD5 839633898178f35f6de0b385b7de0ec7
- SHA1 5396e52c45954f0953cc8cf2095b122f7353180e
- SHA512 b0ed4fce2815dcb783e0b9a786178b337d215e6a4d16df1ddb3c28ccdba13081fee1976669d9f99505cf31b8f1e8d5584fd1aa9732e1add38217222726c76eb8
- SSDEEP 12288:PTj1ZnJmYM1TjXv7aB4hMz0NZZu3VgGVuwY8dXtdIkJrXIW8M:PXMxjTaBcMzYZZuVgGJdXnJbIW8M
- TLSH T1E0C47C02B6C1C837D42E1330489BABBAA27DB6110B65D7D772986B3C6D713D05F33A5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt5270.tmp\mmf2d3d9.dll
- Size 1.5MB
- SHA256 bddda991185a9e83b9855a109f2fcfa78cd2d5402e9db344c6ec77f6ce69a0c5
- MD5 c85bcc9f3049b57aa8ccbb290342ff14
- SHA1 38f5b81a540f1c995ff8d949702440b70921acc5
- SHA512 5097f9d78ddc651aabf41f217f622ee656a1c6de6a9b339354525293102cf631cca2b7babaf991e99e49efe4d1bb6792c8a7a11f82e4ae2081c3961eb9b5afe7
- SSDEEP 24576:rYhBOKa6c8DVYrsz0LbMgPqgVmpiLfmVydmN/9KcAfcLacioayK:v6FjILIgigQrye8cqua5
- TLSH T1CC75BF11B681C036C4B73231065EA37562BDAF211A7495CF17883E7A7F745E2AB3829F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt5270.tmp\mmfs2.dll
- Size 768KB
- SHA256 763ef4484ba9b9e10e19268c045732515f0ac143cf075e6d1ea1f5adcc77633b
- MD5 200520e6e8b4d675b77971dfa9fb91b3
- SHA1 0c583bf4c3eda9c955fd0d0d3ba7fdc62a43bf07
- SHA512 8b7bb334b6bd83ae43e5a4fe32a92b38b1edd2c292c4a540a54c2ee16092eb30108524c1c363508f7c62617bb224d9b447f07cda97ab7de01688acbfbacec51b
- SSDEEP 24576:OAN3eETMNlmLBNc/82oLOsy6rvPXPT1YI:hN3eETMNELBNczoM6rHXPT6
- TLSH T1E4F4AE20BDC5C131D6AA247286BDFFBE19AC66300BB455CB4B881E7A1F201D36F36657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt5270.tmp\mp3flt.sft
- Size 24KB
- SHA256 81c9a9459a8e124793addf142cd513945d6fe600e1d67f74897898d7570e56b2
- MD5 5bebc3ae0122702b89f9262888d3a393
- SHA1 064731c0f1d493b5b82921fa78f06e3d1db95284
- SHA512 c10cb520c2c4a9fe7c371f17ce7f86f138db247468ab1e465dafd7abd294c2beb13cf3a2595b4c8c820d911d8b70842c8f4e45398693c4f0454f973bd58a10a1
- SSDEEP 96:24znrBZKgkk1jqIU9my5F3TM+EXt0D0CZpMC07X7Xbw9pbcPw5KqQ+5lyV:24bXSIXy3IrXtafMCOIpwPRzElq
- TLSH T159B22B12B3A10CF1E55A5E322CE7027B6E75FB9917B4625B9F91C23D1C33901A81B573
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt5270.tmp\ultimatefullscreen.mfx
- Size 73KB
- SHA256 fd179783ff6e6eb0959185087f33ed4a1b256e58762d9817bcb16888e20f7058
- MD5 96059dbec69c3904e4d7ce734a4b38d0
- SHA1 5169934f8d89b0dba963861dcbae55e78fc21dfc
- SHA512 82977b2c249e47ca37d6fd62f416ed995b4b5f953bc5c18c84bfbdacc2c5b17fdc50c1e736fafcac242a3f8921b5000e0ec84302bc4e0077d6eeee3aa43cc520
- SSDEEP 768:SZfXhNSu1qUKsek7uCZCbMh09RzRLh5xjEnR114TkeWeBg7RIAyEDVyncXBwfSV0:aSZc091RLh5xwnl4TkKBUuAMWHwn+q
- TLSH T1A1738E2072D0C072E0AB1679587666705ABE68129BF440CF6FA9067E7FE07E01E79377
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mrt5270.tmp\waveflt.sft
- Size 8KB
- SHA256 92a5053cf5973a6aa228c738d55387f12f1dfa8a837d7b938c60f05b6b56b3ad
- MD5 57ea61dd14314ef155e80c6a0be8a664
- SHA1 963b0ef2fe976ff77044a821fe1e29be4a8cf8a7
- SHA512 cc23cb30d76d22500c3ed7ce9ee0388588309d0779441b95559fce25a42f1eff52ca285c347655f8b33c15b75f9d2067738a151f81f605d3b563799a3a06c9a9
- SSDEEP 96:vLor1Jnr+4O1tLj+Ct2KTOGTrgHchhAfETVdnPstJgxl8V6N/8cKH+ewp:v26Dj9t2ubTVdGJgOcGvw
- TLSH T16FF11B12A7A500F5F8DD0B7134B7627BE875FA285B11C24FC580DE6C0C301E2D928BAB
- MD5 SHA1 SHA512 SSDEEP TLSH