d1436aae15d42fffe91bb0e77114bb66b4c97e58111e09af2a10166790fe6ea1

Analysis

user interaction
yes
max time kernel
40s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Spectrasonics_2048_KeyGen.exe
Size 1.2MB
Sample260511-e795dsex6n
SHA256 d1436aae15d42fffe91bb0e77114bb66b4c97e58111e09af2a10166790fe6ea1
MD5 17174bc990fcfd50bd3f2e00a2d82ed4
SHA1 932ca7164760d452ba89f00e4b58de79a2c9df67
SHA512 6f8a9c56acf9fcc7ebb55399ea5649fa741d2c002fbadc2d831c7d894a15ad3c33acf4c831de724a4ae3c0bcc38c9dc5d5c9be3184ee7cfc230ad48699f09a66
SSDEEP 24576:4cLwbUNL3di0CQki5R5uUO5qgd6fBn6DjPzs0Hjr3HwXBEBSllJ8NY6G:4AwbUNLdrRT5RsR5rd6J6DLXfHwRE075
TLSH
T112552395F99988C3C51A4F3096BBCA71773B6D84A436A6873394FF6EA63325304027C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000700000002432b-16.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
5504	keygen.exe

Loads dropped DLL 5 IoCs

pid	Process
5504	keygen.exe
5504	keygen.exe
5504	keygen.exe
5504	keygen.exe
5504	keygen.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002432e-6.dat	upx
behavioral1/memory/5504-7-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/files/0x000700000002432b-16.dat	upx
behavioral1/memory/5504-21-0x00000000005C0000-0x00000000005D8000-memory.dmp	upx
behavioral1/memory/5504-23-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/5504-26-0x00000000005C0000-0x00000000005D8000-memory.dmp	upx
behavioral1/memory/5504-27-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/5504-31-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/5504-35-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/5504-38-0x00000000005C0000-0x00000000005D8000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spectrasonics_2048_KeyGen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe

Modifies registry class 33 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	keygen.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1572	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1572	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5504	keygen.exe
5504	keygen.exe
5504	keygen.exe
5504	keygen.exe
5504	keygen.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5224 wrote to memory of 5504	5224	Spectrasonics_2048_KeyGen.exe	84

C:\Users\Admin\AppData\Local\Temp\Spectrasonics_2048_KeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\Spectrasonics_2048_KeyGen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5224
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5504

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3dc 0x50
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BASSMOD.DLL

Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL
Size 33KB
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
TLSH
T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R2RSS2048.dll

Path C:\Users\Admin\AppData\Local\Temp\R2RSS2048.dll
Size 232KB
SHA256 762548049d64380584d2e77b5499f4bea16693308ee156618c83f0f0b847b064
MD5 4d97354487a74d33552afc93a7a8e1b9
SHA1 17b4cf7906fb6c69eab34887d8c4d0a7700e4c61
SHA512 4ff392908be02313782b03a6a66ab2edc4c8c427da047fa1e6c64748826ae50f46591366b6ac0e6aaff6803f7b07bcc0a8d7aaba4f9deb0db517041004153f42
SSDEEP 6144:7lIKTzIeVOr1MPZ1GKxfv3PbwrTbhhZiT4X01OA:SCVgMhPf0ZGT+01O
TLSH
T15034234882BD2E49C4E7523769E6EDFEA7903F1BDE24496BC739E07914AF634800E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R2RTOOL.dll

Path C:\Users\Admin\AppData\Local\Temp\R2RTOOL.dll
Size 28KB
SHA256 d224bed5bba63c1b222e6628e19615278490c1139804aafede4627da5be655cc
MD5 0b0214cdf2577a43af135b741d98bc0c
SHA1 3d1c95eeed200a9b354fb9a90d9caa8c5fc41268
SHA512 5a3d89510f580666502106be2cd1940f1c064c2936abf48870654cf271517b91e7cab9e1ce6ebf4408f96e47fcf3a03327c76ce6bf902cc60eeabdce78840e7a
SSDEEP 768:u4yiXjWaELHswCqsE1mzFlcjPeZRUGLe:FMaEYwiE8Flcy3UG
TLSH
T1B3D2E11A5FA9F142C2E087BD936F9E23DB34EC1048D02FEEC69562A76DB8F604107572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bgm.it

Path C:\Users\Admin\AppData\Local\Temp\bgm.it
Size 587KB
SHA256 e66acf2363dab9a21265651887799b00dc1413b2f70155b9b94a4bb9cff045bb
MD5 31f24c0967530394a64cb82ac06a1e2f
SHA1 74a220d2659fa535e71d2f24d1300e7503bb0a2a
SHA512 8a0449902b55cd62cffa24a0b8c65f8e62c47d49b251ad5bf1d964a05f851dbb8b13291e272aa495feb72688ec51ad688ed7f3e320379426f01488b20a44d34d
SSDEEP 12288:WTRjymESIarMryHWESlH5duihTSxF10AT21K6H6iyi39:iymEkrcHEsHzuOabT21K6a1+
TLSH
T190D41227E6E51C49CD7D627AB0D278AEE302F0C9EE59A775649E023374D170D0A9CAC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
Size 287KB
SHA256 62287a6c233820f45e7250caae8ee068425ecf1d229e29316d9f0038401a3751
MD5 f1f1b28254fc2816df83bc4432a6d7cf
SHA1 818d6a94dc8559cd85bc4cc266415aae6cb66f1d
SHA512 d6a809704deec97f12bcfbdac535af404ee48f66126736d6be713c344487edcb2aed2079a3630ffa65a5b7829036ff4d54c1dd0262584ac4bb7e65bcf76093f5
SSDEEP 6144:Cyztgw3QmFzwDK14dHTDtes6EbuA/mQ6LXzkPCu7oAcLOlWz2mBJAVIS:xzh3NeWSzBe3EbucmZz4F9ULvYIS
TLSH
T1B054E03FE9F606F9F94900BC4601D7935CB58CF6A2CEC687499E08AD5856F3D226F068
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5504-24-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5504-26-0x00000000005C0000-0x00000000005D8000-memory.dmp

Download

memory/5504-17-0x0000000002390000-0x000000000242B000-memory.dmp

Download

memory/5504-21-0x00000000005C0000-0x00000000005D8000-memory.dmp

Download

memory/5504-20-0x0000000002390000-0x000000000242B000-memory.dmp

Download

memory/5504-9-0x000000000043B000-0x000000000043C000-memory.dmp

Download

memory/5504-23-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5504-7-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5504-25-0x0000000002390000-0x000000000242B000-memory.dmp

Download

memory/5504-12-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5504-27-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5504-28-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5504-31-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5504-32-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/5504-33-0x0000000002390000-0x000000000242B000-memory.dmp

Download

memory/5504-35-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5504-38-0x00000000005C0000-0x00000000005D8000-memory.dmp

Download

memory/5504-37-0x0000000002390000-0x000000000242B000-memory.dmp

Download

memory/5504-36-0x0000000010000000-0x0000000010013000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads