Resubmissions
30/06/2026, 10:50
260630-mxff2ads2w330/06/2026, 10:43
260630-msjmwsds3n830/06/2026, 10:33
260630-mlg6gsc12m330/06/2026, 10:24
260630-mfqwfacz4p8Analysis
- max time kernel
900s - max time network
455s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
30/06/2026, 10:50
General
- Target DDLCExpansionPack-1.3-pc/DDLCExpansionPack-1.3-pc/DDLCExpansionPack-32.exe
- Size 115KB
- Sample260630-mxff2ads2w
- SHA256 a62e90fcd749cb61047d2c4d5b1430e3b670d55a1093b269b34197b570c1a091
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DDLCExpansionPack-1.3-pc\DDLCExpansionPack-1.3-pc\DDLCExpansionPack-32.exe"C:\Users\Admin\AppData\Local\Temp\DDLCExpansionPack-1.3-pc\DDLCExpansionPack-1.3-pc\DDLCExpansionPack-32.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1820-0-0x00000000027C0000-0x00000000028E5000-memory.dmp
memory/1820-1-0x00000000711E5000-0x00000000711E7000-memory.dmp
memory/1820-127-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-126-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-129-0x0000000064300000-0x000000006430B000-memory.dmp
memory/1820-128-0x00000000027C0000-0x00000000028E5000-memory.dmp
memory/1820-125-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1820-132-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-131-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-137-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-136-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-142-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-141-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-147-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-146-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-152-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-151-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-157-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-156-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-161-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-162-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-167-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-166-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-172-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-171-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-177-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-176-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-182-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-181-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-187-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-186-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-192-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-191-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-197-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-196-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-202-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-201-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-207-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-206-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-212-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-211-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-217-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-216-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-222-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-221-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-227-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-226-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-232-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-231-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-237-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-236-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-242-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-241-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-247-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-246-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-252-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-251-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-257-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-256-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-262-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-261-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-267-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-266-0x0000000070240000-0x0000000071257000-memory.dmp
memory/1820-272-0x000000006D040000-0x000000006D5FF000-memory.dmp
memory/1820-271-0x0000000070240000-0x0000000071257000-memory.dmp