Overview
overview
8Static
static
3Reserva.zip
windows10-2004-x64
8Reserva.zip
windows11-21h2-x64
1Instalar_Cliente.cmd
windows10-2004-x64
8Instalar_Cliente.cmd
windows11-21h2-x64
8Reserva_Nuvem_160.exe
windows10-2004-x64
3Reserva_Nuvem_160.exe
windows11-21h2-x64
3dbexpint.dll
windows10-2004-x64
3dbexpint.dll
windows11-21h2-x64
3gds32.dll
windows10-2004-x64
3gds32.dll
windows11-21h2-x64
3midas.dll
windows10-2004-x64
3midas.dll
windows11-21h2-x64
3reserva.ini
windows10-2004-x64
1reserva.ini
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/06/2026, 16:37
Static task
static1
Behavioral task
behavioral1
Sample
Reserva.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Reserva.zip
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
Instalar_Cliente.cmd
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Instalar_Cliente.cmd
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
Reserva_Nuvem_160.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Reserva_Nuvem_160.exe
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
dbexpint.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
dbexpint.dll
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
gds32.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
gds32.dll
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
midas.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
midas.dll
Resource
win11-20260513-en
Behavioral task
behavioral13
Sample
reserva.ini
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
reserva.ini
Resource
win11-20260513-en
General
- Target gds32.dll
- Size 380KB
- Sample260605-t4vmvsbs41
- SHA256 2a7c59d3b8c45814f6d7b5c2d9334ca0433135b4609a9cc8761aad22c19d1b08
- MD5 1abd772ece0cc871696a867d1f2076d8
- SHA1 7e37a4d4e0eaf2b5bf1cd8c8d4c0c4bfe41acd4e
- SHA512 e886b7d8d9da73f29dbd757bc7624e0a0944701571d5e432909f3dee6a84acdbdec8cb50d9af5782f45c45d012e6aa69ffc0c1f6764e88d6f3cb52d769d7ab81
- SSDEEP 6144:g7bUmSOyjFlmhwxgDmBY9bqWcUg7cOG6xfA/0wdB:g/UmajFlDa9bU93qB
- TLSH T11D848D92F791D070D54A06B93D395B6F7775F688077AC2C3A3C41E6A4832AF12E39293
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1736 wrote to memory of 4196 1736 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\gds32.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\gds32.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4196
-