Overview
overview
3Static
static
3ade.exe
windows10-2004-x64
3ade.exe
windows11-21h2-x64
3adedata.dll
windows10-2004-x64
3adedata.dll
windows11-21h2-x64
3adesdata.dll
windows10-2004-x64
3adesdata.dll
windows11-21h2-x64
3client db maker.exe
windows10-2004-x64
3client db maker.exe
windows11-21h2-x64
3install.bat
windows10-2004-x64
3install.bat
windows11-21h2-x64
3srpclib.dll
windows10-2004-x64
3srpclib.dll
windows11-21h2-x64
3uninstall.bat
windows10-2004-x64
3uninstall.bat
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/06/2026, 12:17
Static task
static1
Behavioral task
behavioral1
Sample
ade.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
ade.exe
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
adedata.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
adedata.dll
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
adesdata.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
adesdata.dll
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
client db maker.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
client db maker.exe
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
install.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
install.bat
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
srpclib.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
srpclib.dll
Resource
win11-20260513-en
Behavioral task
behavioral13
Sample
uninstall.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
uninstall.bat
Resource
win11-20260513-en
General
- Target ade.exe
- Size 1.2MB
- Sample260604-pgdcvad181
- SHA256 b29d3cc23d00dca0380b71d7d353c0410128f17dc2d4f22be6646d011a6a8c46
- MD5 1f0e1a4bb17f6d63a6fc85cd9944d949
- SHA1 1a573a0d799d9556cdd229df9ba8d60f2b72785e
- SHA512 54b01a30a7eb4ab7fbc4897d34c5a5038cd881dda5b3c65b6cef0b823a16ad59b5b3be106e1dc3df6e520e3fdd6f4c2b7dbaf3c78d77977e705e11136a7f60f7
- SSDEEP 6144:X0eaRNbVRCBGYbuQeQjtFOTX4oteaIuFA3NUq9cqW+5CzDwsVOK4lXbBnJY/03x1:X0ecmBBpeSXqqYhFlNJ2gyeeZMU
- TLSH T11355D5329D58DF41D4004233CDBA91EE2F59AC511C166E3766CEF9291E3BA43BFB0A16
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ade.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4432 ade.exe