9bb186e7e7eff3bbe32bb1a4032c41974dfee82698284bbf1f866de45104c7ee

Analysis

geolocation tags

eueuropelondonukunited-kingdom
max time kernel
899s
max time network
441s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/06/2026, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Devil_Engine_666/Devil Engine.exe
Size 397KB
Sample260623-jx6rfaa19p
SHA256 9bb186e7e7eff3bbe32bb1a4032c41974dfee82698284bbf1f866de45104c7ee
MD5 9dfe549b547a928670bfb1b7636f8193
SHA1 80b41d1f6a91fb1d99ef68459b7d6317ef96d47d
SHA512 072ad4345c25cebc37ae0f7898b037fe5ded5277032efd2d46aeec76949d710c24ed9b7067d6b58513dbdaa35d6f24a016042b4346410a2995195ec6cb089e6f
SSDEEP 12288:h010wHrzPcHFQjL2CVpGzJT44EZ8B+gugEnoSE5yi:TwLTclQjL2CVpGzJEZ8B+gugEnoSE5yi
TLSH
T118846C21FA01D237C0627DBC4FA995E52A60F9202CA594CB73E71F4F1A79AE03D79709
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000\Control Panel\International\Geo\Nation	Devil Engine.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\clbcatq.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\msvcp_win.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\RPCRT4.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\SHLWAPI.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\version.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\KERNEL32.DLL	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\opengl32.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\wsock32.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\oleaut32.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\ucrtbase.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\sechost.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\hhctrl.ocx	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\PROPSYS.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\bcrypt.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\dwmapi.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\combase.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\user32.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\kernel.appcore.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\windows.storage.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\win32u.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\GDI32.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\gdi32full.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\shcore.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\system32\uxtheme.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\advapi32.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\msvcrt.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\shell32.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\ole32.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\ws2_32.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\winmm.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\Wldp.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\KERNELBASE.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\imm32.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\comdlg32.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\psapi.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\wininet.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	devilengine-x86_64-SSE4-AVX2.exe
File opened for modification	C:\Windows\System32\bcryptPrimitives.dll	devilengine-x86_64-SSE4-AVX2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.4355_none_60b8b9eb71f62e16\comctl32.dll	devilengine-x86_64-SSE4-AVX2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Devil Engine.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	5056	devilengine-x86_64-SSE4-AVX2.exe
Token: SeTcbPrivilege	5056	devilengine-x86_64-SSE4-AVX2.exe
Token: SeTcbPrivilege	5056	devilengine-x86_64-SSE4-AVX2.exe
Token: SeLoadDriverPrivilege	5056	devilengine-x86_64-SSE4-AVX2.exe
Token: SeCreateGlobalPrivilege	5056	devilengine-x86_64-SSE4-AVX2.exe
Token: SeLockMemoryPrivilege	5056	devilengine-x86_64-SSE4-AVX2.exe
Token: 33	5056	devilengine-x86_64-SSE4-AVX2.exe
Token: SeSecurityPrivilege	5056	devilengine-x86_64-SSE4-AVX2.exe
Token: SeTakeOwnershipPrivilege	5056	devilengine-x86_64-SSE4-AVX2.exe
Token: SeManageVolumePrivilege	5056	devilengine-x86_64-SSE4-AVX2.exe
Token: SeBackupPrivilege	5056	devilengine-x86_64-SSE4-AVX2.exe
Token: SeCreatePagefilePrivilege	5056	devilengine-x86_64-SSE4-AVX2.exe
Token: SeShutdownPrivilege	5056	devilengine-x86_64-SSE4-AVX2.exe
Token: SeRestorePrivilege	5056	devilengine-x86_64-SSE4-AVX2.exe
Token: 33	5056	devilengine-x86_64-SSE4-AVX2.exe
Token: SeIncBasePriorityPrivilege	5056	devilengine-x86_64-SSE4-AVX2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5056	devilengine-x86_64-SSE4-AVX2.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 5056	3068	Devil Engine.exe	82
PID 5056 wrote to memory of 4664	5056	devilengine-x86_64-SSE4-AVX2.exe	90

C:\Users\Admin\AppData\Local\Temp\Devil_Engine_666\Devil Engine.exe
"C:\Users\Admin\AppData\Local\Temp\Devil_Engine_666\Devil Engine.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\Devil_Engine_666\devilengine-x86_64-SSE4-AVX2.exe
  "C:\Users\Admin\AppData\Local\Temp\Devil_Engine_666\devilengine-x86_64-SSE4-AVX2.exe"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Users\Admin\AppData\Local\Temp\Devil_Engine_666\Tutorial-x86_64.exe
    "C:\Users\Admin\AppData\Local\Temp\Devil_Engine_666\Tutorial-x86_64.exe"
    3⤵
    PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5056-0-0x00007FFD08610000-0x00007FFD087A2000-memory.dmp

Download

memory/5056-2-0x00007FFD08610000-0x00007FFD087A2000-memory.dmp