Overview

overview

7

Static

static

3

SisterLocation.exe

windows10-2004-x64

7

SisterLocation.exe

windows11-21h2-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    68s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250502-en
  • resource tags

    arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08/05/2026, 03:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SisterLocation.exe
  • Size 780.8MB
  • Sample260508-ej24wacz2y
  • SHA256 e26b92e0eab6219451057db543b5d0da78f3f166f76faf822a5e5c173dc2070c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 9 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SisterLocation.exe
    "C:\Users\Admin\AppData\Local\Temp\SisterLocation.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2160
  • C:\Windows\System32\GameBarPresenceWriter.exe
    "C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
    1⤵
    • Network Service Discovery
    PID:2224
  • C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\GameBar.exe
    "C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\GameBar.exe" -ServerName:App.AppXbdkk0yrkwpcgeaem8zk81k8py1eaahny.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:924
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
    1⤵
    • Drops desktop.ini file(s)
    • Checks processor information in registry
    • Modifies registry class
    PID:5020
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:6128

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Perspective.mfx
        • Path C:\Users\Admin\AppData\Local\Temp\mrtACE9.tmp\Perspective.mfx
        • Size 15KB
        • SHA256 090925a4cd961f22b1ecd2fba4ce04ab063e26507a1dc09b1d6a40c4860a8777
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kcclock.mfx
        • Path C:\Users\Admin\AppData\Local\Temp\mrtACE9.tmp\kcclock.mfx
        • Size 108KB
        • SHA256 f2319a7359fbcb8860f1c468aad602383c49effb7c110de01ff13acdcf3a5ab9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kcini.mfx
        • Path C:\Users\Admin\AppData\Local\Temp\mrtACE9.tmp\kcini.mfx
        • Size 28KB
        • SHA256 52cdd0d5265dbe45966a787d0082e01ada41553c898f02347840aded98d6332f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mmf2d3d9.dll
        • Path C:\Users\Admin\AppData\Local\Temp\mrtACE9.tmp\mmf2d3d9.dll
        • Size 1.1MB
        • SHA256 fce87bf918787de7e8be0419941033dd98285eba51c79cfe16295f06e7b7cbc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mmfs2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\mrtACE9.tmp\mmfs2.dll
        • Size 459KB
        • SHA256 1cb098cfa35e4692cc2759a1b23100a1f6ccdc6da4dc2bd5abb586e207eeb0e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mp3flt.sft
        • Path C:\Users\Admin\AppData\Local\Temp\mrtACE9.tmp\mp3flt.sft
        • Size 24KB
        • SHA256 cd5bd7cc59eaf42bc0edf418ce6f077f9db369d5e3c414107b82492a877a6176
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        waveflt.sft
        • Path C:\Users\Admin\AppData\Local\Temp\mrtACE9.tmp\waveflt.sft
        • Size 8KB
        • SHA256 41136b09b033a20b9acc430620ea095ff76afbdc7aebe7f26f7d2b4315afddef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        desktop.ini
        • Path C:\Users\Admin\Videos\Captures\desktop.ini
        • Size 190B
        • SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2160-44-0x0000000004080000-0x0000000004102000-memory.dmp
        Download

        memory/5020-45-0x000001540F9D0000-0x000001540F9E2000-memory.dmp
        Download