Overview
overview
8Static
static
7STEAMRIP ...es.url
windows11-ltsc_2024-x64
1Undertale/...43.dll
windows11-ltsc_2024-x64
3Undertale/...er.dll
windows11-ltsc_2024-x64
3Undertale/...le.exe
windows11-ltsc_2024-x64
6Undertale/codex.dll
windows11-ltsc_2024-x64
8Undertale/...pi.dll
windows11-ltsc_2024-x64
3Undertale/...pi.dll
windows11-ltsc_2024-x64
3Undertale/...nt.dll
windows11-ltsc_2024-x64
3_CommonRed...up.exe
windows11-ltsc_2024-x64
7_CommonRed...st.exe
windows11-ltsc_2024-x64
8_CommonRed...64.exe
windows11-ltsc_2024-x64
6_CommonRed...86.exe
windows11-ltsc_2024-x64
4_CommonRed...64.exe
windows11-ltsc_2024-x64
7_CommonRed...86.exe
windows11-ltsc_2024-x64
7_CommonRed...st.msi
windows11-ltsc_2024-x64
7Analysis
- max time kernel
899s - max time network
472s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/06/2026, 21:44
Static task
static1
Behavioral task
behavioral1
Sample
STEAMRIP ยป Free Pre-installed Steam Games.url
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral2
Sample
Undertale/D3DX9_43.dll
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral3
Sample
Undertale/GameOverlayRenderer.dll
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral4
Sample
Undertale/Undertale.exe
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral5
Sample
Undertale/codex.dll
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral6
Sample
Undertale/steam_api.dll
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral7
Sample
Undertale/steam_api.dll
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral8
Sample
Undertale/steamclient.dll
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral9
Sample
_CommonRedist/dxwebsetup.exe
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral10
Sample
_CommonRedist/oalinst.exe
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral11
Sample
_CommonRedist/vcredist_2015-2019_x64.exe
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral12
Sample
_CommonRedist/vcredist_2015-2019_x86.exe
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral13
Sample
_CommonRedist/vcredist_x64.exe
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral14
Sample
_CommonRedist/vcredist_x86.exe
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral15
Sample
_CommonRedist/xnafx40_redist.msi
Resource
win11ltsc2024-20260618-en
General
- Target Undertale/D3DX9_43.dll
- Size 1.9MB
- Sample260627-1lrltady2t
- SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
- MD5 86e39e9161c3d930d93822f1563c280d
- SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
- SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
- SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
- TLSH T14895AF51C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB8BE1EAB8387
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3624 wrote to memory of 1868 3624 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Undertale\D3DX9_43.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Undertale\D3DX9_43.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1868
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3648
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:1428