Overview
overview
3Static
static
3LoadTester.exe
windows10-2004-x64
3LoadTester.exe
windows11-21h2-x64
3RTCore.dll
windows10-2004-x64
3RTCore.dll
windows11-21h2-x64
3RTShutDown.bat
windows10-2004-x64
RTShutDown.bat
windows11-21h2-x64
RealTemp.exe
windows10-2004-x64
3RealTemp.exe
windows11-21h2-x64
3RealTempGT.exe
windows10-2004-x64
3RealTempGT.exe
windows11-21h2-x64
3WinRing0.dll
windows10-2004-x64
3WinRing0.dll
windows11-21h2-x64
3WinRing0.sys
windows10-2004-x64
1WinRing0.sys
windows11-21h2-x64
1WinRing0x64.dll
windows10-2004-x64
1WinRing0x64.dll
windows11-21h2-x64
1WinRing0x64.sys
windows10-2004-x64
1WinRing0x64.sys
windows11-21h2-x64
1i7TurboGT.exe
windows10-2004-x64
3i7TurboGT.exe
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/05/2026, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
LoadTester.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
LoadTester.exe
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
RTCore.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral4
Sample
RTCore.dll
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
RTShutDown.bat
Resource
win10v2004-20260130-en
Behavioral task
behavioral6
Sample
RTShutDown.bat
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
RealTemp.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral8
Sample
RealTemp.exe
Resource
win11-20260130-en
Behavioral task
behavioral9
Sample
RealTempGT.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral10
Sample
RealTempGT.exe
Resource
win11-20260130-en
Behavioral task
behavioral11
Sample
WinRing0.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral12
Sample
WinRing0.dll
Resource
win11-20260130-en
Behavioral task
behavioral13
Sample
WinRing0.sys
Resource
win10v2004-20260130-en
Behavioral task
behavioral14
Sample
WinRing0.sys
Resource
win11-20260130-en
Behavioral task
behavioral15
Sample
WinRing0x64.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral16
Sample
WinRing0x64.dll
Resource
win11-20260130-en
Behavioral task
behavioral17
Sample
WinRing0x64.sys
Resource
win10v2004-20260130-en
Behavioral task
behavioral18
Sample
WinRing0x64.sys
Resource
win11-20260130-en
Behavioral task
behavioral19
Sample
i7TurboGT.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral20
Sample
i7TurboGT.exe
Resource
win11-20260130-en
General
- Target i7TurboGT.exe
- Size 55KB
- Sample260504-ff2jlsf18j
- SHA256 357da77e83c85cef0b930547c8a0c8662829fea0befeded0f7e3949474ecb94c
- MD5 48e61f94beb8b46a906ad7e95b38e73f
- SHA1 6b01513e77ac25630d5976fa7044eca3496af856
- SHA512 8d7f4a7621e36e8dc0d7080fe2d08b1068d0327076e343090dfec6537ecb5dc86e45cf6797cd1aaf90c8ded8fc683b2f3f5c1db7d8902201702963ec8a71ee9e
- SSDEEP 768:KMgzGjiO9raKHWHS1EhmsTJa3W94OVEZBtoW2AgSbtFDW5Yg4+9Z0Hi7FDK:1nH6S1EhmZ3WCjt2AxtpWaD+9WiBDK
- TLSH T146435CA35E56C466D300887041BED3B6CA72F96225258B1F7BD8DD3D393AB42ED1832D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i7TurboGT.exe - Suspicious behavior: LoadsDriver 4 IoCs
pid Process 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4864 i7TurboGT.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4864 i7TurboGT.exe 4864 i7TurboGT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\i7TurboGT.exe"C:\Users\Admin\AppData\Local\Temp\i7TurboGT.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4864
-
C:\Users\Admin\AppData\Local\Temp\WinRing0x64.sysC:\Users\Admin\AppData\Local\Temp\WinRing0x64.sys1⤵PID:3980