15df1d4f3e634a077ed2e874c2d974928cfc73c6805dc3a72b7433e393b1cfb9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$_54_/13.7.0.41868/Assistant/2345Capture.exe
Size 394KB
Sample260527-3tkvcads61
SHA256 15df1d4f3e634a077ed2e874c2d974928cfc73c6805dc3a72b7433e393b1cfb9
MD5 bc7af507ca5b5d8a3e1c4b80b77fdc23
SHA1 0e990da22904b343c9c5837cf23d09cb530945b5
SHA512 30d6e8f2806186582b5bc98cc35447d08960fcafc4ea39f5ce640333a97d327e30b2db38226827c64b026c37d09f4f318fa00b50977f1248f5f4d432757cffa4
SSDEEP 6144:LIgjHK8DC41oR+6vQSMnKTjAOq7sTBH0piGkYIkRHSGq0IjUPqL5yB:LI4K8ic6Mn6I7sTh0bxHbImqL5yB
TLSH
T18F84AE107292C632D676013196F99EBA546E7E140F3049DB63C83F2ABD702D26A36F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
28	2944	2345Capture.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345Capture.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2345Capture.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	2345Capture.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2345Capture.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2345Capture.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2156	2345Capture.exe
2156	2345Capture.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2156	2345Capture.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2944	2156	2345Capture.exe	85

C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\Assistant\2345Capture.exe
"C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\Assistant\2345Capture.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\Assistant\2345Capture.exe
  "C:\Users\Admin\AppData\Local\Temp\$_54_\13.7.0.41868\Assistant\2345Capture.exe" -update -update-platform-x32
  2⤵
  - Downloads MZ/PE file
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:2944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

68FAF71AF355126BCA00CE2E73CC7374_704DB72A6A2E46A3FF91601783F02A70

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68FAF71AF355126BCA00CE2E73CC7374_704DB72A6A2E46A3FF91601783F02A70
Size 1KB
SHA256 238932a1964ce7fcb4e851cf2a48cee853392acb310dd43dbeda772b30e8418d
MD5 33cc14bee7eaa6d689b23dc0afc4989f
SHA1 4d84fb7deb6791cdc25186711164e82561226218
SHA512 beed927b3e90f797c23967053752321f5cefd37a2b14fe0b5367ba6f39e5172817b28b55750d128211d6cf5cf291d9a0b28ca138c2c7ffa9ad58d0ccfb7cc9a4
TLSH
T12031E7690B6168A51FA34D800FCAE63D8875B5C509202016307DEFE9DEC3BBA7A39C1C
MD5 SHA1 SHA512 TLSH

Submit Download

97228C95A7FA84730C984164CDDEDFA2_EC5678EC1C8177C82804B194A2FEA5BB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\97228C95A7FA84730C984164CDDEDFA2_EC5678EC1C8177C82804B194A2FEA5BB
Size 2KB
SHA256 1876d800fce272b295dcf3ec4de81bedd50e604a978c1f1d837ddaa4f0da143f
MD5 4d45b80c7f43b945d2f33a1b3cbbf2df
SHA1 cab53b968b245d856d2ec47dc4ebd4ee527a6657
SHA512 98f08f4445c67e4738007fb6eaecf1cd5c62d65b779420f001364b702b672241ac8d7f612f5eee28e081052cc76a58b97dbb58aa69029604eb83c7e777c4be82
TLSH
T10A412D251FB179109375D7684AE6C93B8C7ED2C2B25128A35488489EC4593B83ED727F
MD5 SHA1 SHA512 TLSH

Submit Download

9D8AF0126AAC1DAB3F1BC1E17FDE1869_34948CD87F7EAE19AF4448D3E05A2818

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9D8AF0126AAC1DAB3F1BC1E17FDE1869_34948CD87F7EAE19AF4448D3E05A2818
Size 2KB
SHA256 ab99ee3a22a66182fcb77d6d3c8048e58e6319ecfa5823bef70c166168249918
MD5 0de7efe896f4a6e2cbab456a9666b9dc
SHA1 a154c40e44c162a58394c997a1fb3b64a4a7a201
SHA512 6042ca07480d151e8f00f85a11c99a2460eb27c3c8f01bb7ee6e38221af6109ca28b01b6dd281f1e708966eca2abab2918ca3b77df710b4a822d78191f8a1f46
TLSH
T10041E8030BD71824BE46BDB78F1AE5792CF25ACA45881901249D91E85683FAA7A7843D
MD5 SHA1 SHA512 TLSH

Submit Download

68FAF71AF355126BCA00CE2E73CC7374_704DB72A6A2E46A3FF91601783F02A70

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\68FAF71AF355126BCA00CE2E73CC7374_704DB72A6A2E46A3FF91601783F02A70
Size 404B
SHA256 6f1c8b5a039c2947c3011a54972370281dca120456d18aa6561ed3c8ddc417cd
MD5 2658de63cee84490fac2209eab4cce20
SHA1 f5c9ab49f45006c759cb2ea9e12586b496cae8a8
SHA512 47485801a106a76c856256dbd5a8579ded3c83fb5d62fe840c63f17078fa2df23fe294272bdf3f49635a0b7b78c6ea8adecc3a3b8d3fe0eff7e8f0d6ae24501b
TLSH
T1E1E0203421EE505DF935CAFD02CD77E55B2AF937143927EE059007077D109400C91931
MD5 SHA1 SHA512 TLSH

Submit Download

97228C95A7FA84730C984164CDDEDFA2_EC5678EC1C8177C82804B194A2FEA5BB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\97228C95A7FA84730C984164CDDEDFA2_EC5678EC1C8177C82804B194A2FEA5BB
Size 440B
SHA256 854dc9c935ccdfc1d144738b099256bae66973cea8bc3a18b4f392027b5bef8b
MD5 e26232796f3d7345925f05ae939405c0
SHA1 924e4dfa9c8b1f38d969e12b36b12f93fc01f51b
SHA512 e3d4b10e27f53bdba66607f9645be5d0a61ca64fed80253aa24a8a0e832f968ce939725ceed4d2956b49b9109401d321267deabba2f92f1cb515364229486202
TLSH
T18CF0260012B9915CF236FFB8EECCA626952FE3020666E9A41155160C5246D008CF3A3D
MD5 SHA1 SHA512 TLSH

Submit Download

9D8AF0126AAC1DAB3F1BC1E17FDE1869_34948CD87F7EAE19AF4448D3E05A2818

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9D8AF0126AAC1DAB3F1BC1E17FDE1869_34948CD87F7EAE19AF4448D3E05A2818
Size 412B
SHA256 a76e60dfc66b3e6b1b85d892edc134a51bd3cbd04f3625df8e389f8ac0e054ea
MD5 77c2b8660bb7a01775f09abdd4434c34
SHA1 1fac05d6b580e20aea0b839f2182995b3005aa5d
SHA512 94af26ed75f4a8974904546f167411634f8da57dcf66ec1e60c0512067f983efc882bef89b06718aee07e0c0f30f810f52ef45bb0590cde613dde05cc68149e3
TLSH
T14CE0D83529EB4129E2B5EC7A55C6B3628D6EF133052967F5116026097E03D409C61A54
MD5 SHA1 SHA512 TLSH

Submit Download

cloudconfig.dat

Path C:\Users\Admin\AppData\Roaming\2345Capture\cloudconfig.dat
Size 169B
SHA256 291361eb6263d7bed605b7dad9a730fceadee2af4ec1907b3b10c3b29a33f0d7
MD5 6a45993abbeb52b685a168a208b762a9
SHA1 682ed67e6d85ad83eb30ab4c1ab2ca2f02a9acfb
SHA512 04ad6b366d3ae559b1d571874aff73d594cc2ff8a4a5e2c162fc8db2c12c7732e6b5885bf2570e0ec05b07e8cc0bfe43a1044af6f9d12cd192d9c5524bcdb948
TLSH
T164C02BA9676C030BEA3E6334807D0304AA757C9E1474C2CE10C0308C8C46B90BEE077D
MD5 SHA1 SHA512 TLSH

Submit Download

ExtractDllFile

Path C:\Users\Admin\AppData\Roaming\2345Capture\update\download\ExtractDllFile
Size 975KB
SHA256 8c5c684d4106a43bbdd2548ca9788d01d8ea934f08a6e33e7afa00336e29ac79
MD5 b1ca8d161f9f34687870dc397bf7fa36
SHA1 af06662c6ffac5bfd88c1e3a2c9dd00a62d1b4a0
SHA512 161f739fc791a568cbc355a0f572d299fc8e83bd51a5d3a9ce791b69312c71021663c1f287e250fd3dc3881ab50db2cb8dda8b3c83842738c4b2dab923fb0a66
SSDEEP 24576:nAj0WyZnxZ4MRG0qMP8DReP3INv+85Ruk0KCqGcWbKxfKe2:njWyZnxZ4/0qM4RbNGCRuk4qGLbKxfKt
TLSH
T144257C11BA4AC135D6BC6273593CAF5A40AD2B6C4F7045CBE794BE2ADC301E31978D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download