05a48e79bd90e987a5c0f34e5122a02d54f244925ffc84ef31cc4441b702c6f1

Analysis

user interaction
yes
max time kernel
148s
max time network
143s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
11/05/2026, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WavesFactory_KeyGen.exe
Size 331KB
Sample260511-dv4lead12m
SHA256 05a48e79bd90e987a5c0f34e5122a02d54f244925ffc84ef31cc4441b702c6f1
MD5 a1f8f95efd76ad74d16784d2d90a3910
SHA1 2e130a5bd2ab15c92c37595d621981d68950941d
SHA512 2d417a54835a7d24ea0c872e462403c575b336426ada651db5a59c1b762f37e9fe7097118dddfe96ea15fa222dcd6e51703519916d0c2aab2dbf9db2a9f32b25
SSDEEP 6144:iay2nA8P9tlASRzKW3kJ40GijbnIW+4YH0mJADi1vny5WHTqtBr:sc9t2SllUlGUUT4YHhADzWH2tBr
TLSH
T10F740122FD5048E3C9B7577044BF9D2136BB6D29CA73164B63D8B728B6B3342611B683
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1276	keygen.exe

Loads dropped DLL 1 IoCs

pid	Process
1276	keygen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WavesFactory_KeyGen.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 1276	4224	WavesFactory_KeyGen.exe	83

C:\Users\Admin\AppData\Local\Temp\WavesFactory_KeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\WavesFactory_KeyGen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1276

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x3bc
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BASSMOD.DLL

Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL
Size 33KB
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
TLSH
T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
Size 469KB
SHA256 b4cdc3b4b3244df3e5662ab12af0db0658586bc54cd4d62c3760d503834a4243
MD5 5616de754031bd616899ecba3fe8a044
SHA1 904212738fed43ace5bca75900029c50cf7c27ef
SHA512 35c27d40e52c1348f9143864b17a700da859711ec2a596494aa94b594d975e503937cd5350d72992ac49f39c74d919b8fcc87826ef8c7957c4f4e5b6e4d8a51e
SSDEEP 12288:tpGVQ4KQonRBVrzRNyffhykUVV35H35JpVSSChb/9EiFm3fJHjHtr3JftrTpN+hI:tp1QonRBVrz+ffhykUVV35H35JpVSSCm
TLSH
T106A42A2327F6F861F276E0B51C1B45E76CB99890C390F7D36A770945CE226A88D72D0B
MD5 SHA1 SHA512 SSDEEP TLSH