Overview
overview
4Static
static
33rdParty/w...le.exe
windows10-2004-x64
33rdParty/w...le.exe
windows11-21h2-x64
3BASSMOD.dll
windows10-2004-x64
3BASSMOD.dll
windows11-21h2-x64
3BassMOD.Net.dll
windows10-2004-x64
1BassMOD.Net.dll
windows11-21h2-x64
1CommonHelpers.dll
windows10-2004-x64
3CommonHelpers.dll
windows11-21h2-x64
3CrapInstaller.dll
windows10-2004-x64
3CrapInstaller.dll
windows11-21h2-x64
4CrazyInstaller.exe
windows10-2004-x64
3CrazyInstaller.exe
windows11-21h2-x64
3ExternalLi...et.dll
windows10-2004-x64
1ExternalLi...et.dll
windows11-21h2-x64
1ExternalLi...ET.dll
windows10-2004-x64
3ExternalLi...ET.dll
windows11-21h2-x64
3ICSharpCod...ib.dll
windows10-2004-x64
1ICSharpCod...ib.dll
windows11-21h2-x64
1IOManager.dll
windows10-2004-x64
1IOManager.dll
windows11-21h2-x64
1InstallerS...rm1.js
windows10-2004-x64
3InstallerS...rm1.js
windows11-21h2-x64
3InstallerS...er.vbs
windows10-2004-x64
1InstallerS...er.vbs
windows11-21h2-x64
1InstallerS...es.vbs
windows10-2004-x64
1InstallerS...es.vbs
windows11-21h2-x64
1Ionic.Zlib.dll
windows10-2004-x64
1Ionic.Zlib.dll
windows11-21h2-x64
1KeyStego.exe
windows10-2004-x64
3KeyStego.exe
windows11-21h2-x64
3LoaderManager.dll
windows10-2004-x64
1LoaderManager.dll
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/05/2026, 16:27
Static task
static1
Behavioral task
behavioral1
Sample
3rdParty/wbfs_file.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
3rdParty/wbfs_file.exe
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
BASSMOD.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral4
Sample
BASSMOD.dll
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
BassMOD.Net.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral6
Sample
BassMOD.Net.dll
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
CommonHelpers.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral8
Sample
CommonHelpers.dll
Resource
win11-20260130-en
Behavioral task
behavioral9
Sample
CrapInstaller.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral10
Sample
CrapInstaller.dll
Resource
win11-20260130-en
Behavioral task
behavioral11
Sample
CrazyInstaller.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral12
Sample
CrazyInstaller.exe
Resource
win11-20260130-en
Behavioral task
behavioral13
Sample
ExternalLibraries/BassMOD.Net.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral14
Sample
ExternalLibraries/BassMOD.Net.dll
Resource
win11-20260130-en
Behavioral task
behavioral15
Sample
ExternalLibraries/irrKlang.NET.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral16
Sample
ExternalLibraries/irrKlang.NET.dll
Resource
win11-20250610-en
Behavioral task
behavioral17
Sample
ICSharpCode.SharpZipLib.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral18
Sample
ICSharpCode.SharpZipLib.dll
Resource
win11-20260130-en
Behavioral task
behavioral19
Sample
IOManager.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral20
Sample
IOManager.dll
Resource
win11-20260130-en
Behavioral task
behavioral21
Sample
InstallerStub/Form1.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral22
Sample
InstallerStub/Form1.js
Resource
win11-20260130-en
Behavioral task
behavioral23
Sample
InstallerStub/Properties/Resources.Designer.vbs
Resource
win10v2004-20260130-en
Behavioral task
behavioral24
Sample
InstallerStub/Properties/Resources.Designer.vbs
Resource
win11-20260130-en
Behavioral task
behavioral25
Sample
InstallerStub/Properties/Resources.vbs
Resource
win10v2004-20260130-en
Behavioral task
behavioral26
Sample
InstallerStub/Properties/Resources.vbs
Resource
win11-20260130-en
Behavioral task
behavioral27
Sample
Ionic.Zlib.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral28
Sample
Ionic.Zlib.dll
Resource
win11-20260130-en
Behavioral task
behavioral29
Sample
KeyStego.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral30
Sample
KeyStego.exe
Resource
win11-20260130-en
Behavioral task
behavioral31
Sample
LoaderManager.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral32
Sample
LoaderManager.dll
Resource
win11-20250610-en
General
- Target CommonHelpers.dll
- Size 4KB
- Sample260508-tx9s7set2r
- SHA256 4254539ddef0c3f8d39513874aa8f682f0573393010c2d47cd6241fec84b2c39
- MD5 4ec9e2d60374f39309d24012383719e0
- SHA1 99b9c630ff3ab7fbeba471ef2a472a4c91790848
- SHA512 d7b0c48512ef2d40f75b827ad265d4f95bb044080d9e6983b7f29a0d25974ff64724344a1285ae1e607c9779545a84abd65bed5d4c0aefbe1bebd3543fe117c7
- SSDEEP 48:6cZhou1qe6k/uycmziWh3fAIWWuJgK3/rfyXYyQXOsBtuHleWXvg3aF:ruyok4MLh3fAHPPE1/
- TLSH T1A991641163E84776E8360BF1AD732251927AFA408F634B2F0588531A9C2AD398F52F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2872 wrote to memory of 1216 2872 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\CommonHelpers.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\CommonHelpers.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1216
-