Overview
overview
8Static
static
7Crack.zip
windows10-2004-x64
1Crack.zip
windows11-ltsc_2024-x64
1Crack/ASC.exe
windows10-2004-x64
1Crack/ASC.exe
windows11-ltsc_2024-x64
8Crack/OFCommon.dll
windows10-2004-x64
4Crack/OFCommon.dll
windows11-ltsc_2024-x64
4Crack/Scan.dll
windows10-2004-x64
3Crack/Scan.dll
windows11-ltsc_2024-x64
3Crack/madexcept_.dll
windows10-2004-x64
3Crack/madexcept_.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/06/2026, 04:48
Behavioral task
behavioral1
Sample
Crack.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Crack.zip
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral3
Sample
Crack/ASC.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Crack/ASC.exe
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral5
Sample
Crack/OFCommon.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Crack/OFCommon.dll
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral7
Sample
Crack/Scan.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
Crack/Scan.dll
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral9
Sample
Crack/madexcept_.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
Crack/madexcept_.dll
Resource
win11ltsc2024-20260617-en
General
- Target Crack/OFCommon.dll
- Size 941KB
- Sample260620-ffed3sev2v
- SHA256 9b58084f6319f46a1a75bee60c6b6a74925d52101042d435c5258fc0dab204a2
- MD5 cddf0d6fc267da4e98779749d26c9c40
- SHA1 cae85047a5a119ad7443e4280d06eb4da3ae9917
- SHA512 1853689ced55df50c211ef24bf19f509501403b1d803ad26223171aaf4b332f1a7f50b594afbcea06ef5e2a0283310a42fd06cff8634bd42dbd7e46a2abac295
- SSDEEP 24576:hfzBhfbT1pe+1uTN7CQiBIWcUc0LLbH50Yn2RtjIN7CQiBIWcUc0LLbH51nxYQt8:hfVxne+4TN7CQiBIWcUc0LLbH50Yn2R2
- TLSH T13A250612E28646F0DC593B7124355C580A362EE97EFD960E4F3DF4AD6BB23E314325A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\IObit\Advanced SystemCare\License.ini rundll32.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5848 wrote to memory of 3560 5848 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Crack\OFCommon.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Crack\OFCommon.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3560
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\IObit\Advanced SystemCare\License.log
- Size 629B
- SHA256 2eeac57c1a38a3580e1cffb74773fe33d796e8156842f67fb52276006d236e20
- MD5 b0657574b6789309600aa4b7447fafe5
- SHA1 db23dba1888bad7eebeb0580923b8d8e24e79d48
- SHA512 897964deccb24cc68df739d7b341d6ee82cb2897be5808ca536120252dd78e561e600ea110a7d3a28452f7a9c1cfcbf025df56c17bfd85f6213a0aa87b0e79cb
- TLSH T1BDF09C1017FBB505E9490570A9C506BF1637F5B9370FE0B67998BA8AF03016EFEC4AA1
- MD5 SHA1 SHA512 TLSH