Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 09:17

General

  • Target
    35c9e15c876c3668d18d97f14fa6557467da508fc27ffd60f71e430a473fd28f.exe
  • Size 3.8MB
  • Sample260702-k87csadv6k
  • SHA256 35c9e15c876c3668d18d97f14fa6557467da508fc27ffd60f71e430a473fd28f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35c9e15c876c3668d18d97f14fa6557467da508fc27ffd60f71e430a473fd28f.exe
    "C:\Users\Admin\AppData\Local\Temp\35c9e15c876c3668d18d97f14fa6557467da508fc27ffd60f71e430a473fd28f.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5904
    • C:\Users\Admin\AppData\Local\Temp\is-BOHO3.tmp\35c9e15c876c3668d18d97f14fa6557467da508fc27ffd60f71e430a473fd28f.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BOHO3.tmp\35c9e15c876c3668d18d97f14fa6557467da508fc27ffd60f71e430a473fd28f.tmp" /SL5="$40242,3068201,772096,C:\Users\Admin\AppData\Local\Temp\35c9e15c876c3668d18d97f14fa6557467da508fc27ffd60f71e430a473fd28f.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5988
      • C:\Program Files\GM5GamingMouse\GM5newGM.exe
        "C:\Program Files\GM5GamingMouse\GM5newGM.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:6808

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        GM5newGM.exe

        • Path C:\Program Files\GM5GamingMouse\GM5newGM.exe
        • Size 8.6MB
        • SHA256 e76ba9c9bb7e1c12e98a8d9547a90eed55e416566c34260bd9c94aa2e016d195
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KeyboardHook.dll

        • Path C:\Program Files\GM5GamingMouse\KeyboardHook.dll
        • Size 10KB
        • SHA256 13a780a96cb9f924bdcfa6525f863c7f534b6c959f3f914a09ef2a3847b281b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Logo pic.png

        • Path C:\Program Files\GM5GamingMouse\skins\Logo pic.png
        • Size 30KB
        • SHA256 5dc9ddd37077e6ebdb15c7256502fc85fcf79c3675f7c2c8fa16f6eaa659e38d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Status_BLE.png

        • Path C:\Program Files\GM5GamingMouse\skins\Status_BLE.png
        • Size 3KB
        • SHA256 9fefbf70a2aea95984496e9ea0a0793b8bf8cce5ce110373d2f7c855921ed59e
        • MD5 SHA1 SHA512 TLSH

        Status_Wired.png

        • Path C:\Program Files\GM5GamingMouse\skins\Status_Wired.png
        • Size 3KB
        • SHA256 3fe939fb07903c2bbb18207150e963e65425b2b792b8f511fdd66a17ad2818b4
        • MD5 SHA1 SHA512 TLSH

        Status_Wireless.png

        • Path C:\Program Files\GM5GamingMouse\skins\Status_Wireless.png
        • Size 1KB
        • SHA256 b6dc34f2416f7d0ca94d5eb59348f5f54c9a0b28dc78142da8c415b783ef0b10
        • MD5 SHA1 SHA512 TLSH

        add_nr.png

        • Path C:\Program Files\GM5GamingMouse\skins\add_nr.png
        • Size 2KB
        • SHA256 b189e0e1468abe5127dec9feda3fda08836691757c54614e34dbc381224c7974
        • MD5 SHA1 SHA512 TLSH

        add_ov.png

        • Path C:\Program Files\GM5GamingMouse\skins\add_ov.png
        • Size 2KB
        • SHA256 4b9c363c26319c6e6f70b1ccc41375cbcf29c73f9b3bcacbe1c4ca95482c9d22
        • MD5 SHA1 SHA512 TLSH

        battery_charging.png

        • Path C:\Program Files\GM5GamingMouse\skins\battery_charging.png
        • Size 3KB
        • SHA256 8f7555b1c79366d8e76ded8c503773fe713e232d9d22c0062de179e65a4efead
        • MD5 SHA1 SHA512 TLSH

        battery_empty.png

        • Path C:\Program Files\GM5GamingMouse\skins\battery_empty.png
        • Size 2KB
        • SHA256 760354c2e2889d612b4396b5416af510aad99768003e29149790e6cda6642df5
        • MD5 SHA1 SHA512 TLSH

        battery_full.png

        • Path C:\Program Files\GM5GamingMouse\skins\battery_full.png
        • Size 3KB
        • SHA256 d3865dd9077b866cfa841f66d54431d20da652f4f974f07633d5f82df054ee27
        • MD5 SHA1 SHA512 TLSH

        battery_green.png

        • Path C:\Program Files\GM5GamingMouse\skins\battery_green.png
        • Size 2KB
        • SHA256 686bbfdfdcef7cf7e448b6ec6198ab7cfe9fe03da2ff5f37e2750b302a684653
        • MD5 SHA1 SHA512 TLSH

        battery_lighting.png

        • Path C:\Program Files\GM5GamingMouse\skins\battery_lighting.png
        • Size 2KB
        • SHA256 dc03a0d575a77a1086bf03378ad5004a24bf296a7497d63a2938c1eaccc8bd80
        • MD5 SHA1 SHA512 TLSH

        battery_orange.png

        • Path C:\Program Files\GM5GamingMouse\skins\battery_orange.png
        • Size 2KB
        • SHA256 5a1355e628a38bdafdbf18bd65ea07a7ffee0669648e3ecbf665a65931872215
        • MD5 SHA1 SHA512 TLSH

        battery_red.png

        • Path C:\Program Files\GM5GamingMouse\skins\battery_red.png
        • Size 2KB
        • SHA256 e8b2b0a74e5ef38942d1628614fe19bc79ae75b67d4fe3d921b26e95be388e8d
        • MD5 SHA1 SHA512 TLSH

        button1_nr.png

        • Path C:\Program Files\GM5GamingMouse\skins\button1_nr.png
        • Size 2KB
        • SHA256 ee0dd51da59ce0a6cae0791452d5cb84cff2ed8bee6e650a8bc8a45262bf14db
        • MD5 SHA1 SHA512 TLSH

        button1_ov.png

        • Path C:\Program Files\GM5GamingMouse\skins\button1_ov.png
        • Size 3KB
        • SHA256 ea10403aa4dbc33d4b33b08fca1d82313f3fc3842260279e884f7d9598624db9
        • MD5 SHA1 SHA512 TLSH

        check_dn.png

        • Path C:\Program Files\GM5GamingMouse\skins\check_dn.png
        • Size 2KB
        • SHA256 6c4689655b178a576f598bc422b0f2f65a2f29f7c06533c5482d6296c10f6dad
        • MD5 SHA1 SHA512 TLSH

        check_nr.png

        • Path C:\Program Files\GM5GamingMouse\skins\check_nr.png
        • Size 2KB
        • SHA256 06568a9337aabb279e0ca839a258fb0b9554f1bf528546b5d069a385e766711e
        • MD5 SHA1 SHA512 TLSH

        check_ov.png

        • Path C:\Program Files\GM5GamingMouse\skins\check_ov.png
        • Size 2KB
        • SHA256 12e9dd4c3128bbb0d14995a5f7bd7895074f824cdcf747c8220b61dca6bd923d
        • MD5 SHA1 SHA512 TLSH

        combo2_ov.png

        • Path C:\Program Files\GM5GamingMouse\skins\combo2_ov.png
        • Size 3KB
        • SHA256 898baf52c0dcfa2173554b0293e84597859933a36b1a99ef5f578e69b7e8bc7f
        • MD5 SHA1 SHA512 TLSH

        device name.png

        • Path C:\Program Files\GM5GamingMouse\skins\device name.png
        • Size 2KB
        • SHA256 5dfdbecc6c937d79c9cdfe15593c3f9cb09f1588108ccf26fe97afcdc4d2f676
        • MD5 SHA1 SHA512 TLSH

        exit_nr.png

        • Path C:\Program Files\GM5GamingMouse\skins\exit_nr.png
        • Size 3KB
        • SHA256 24a862e0fb4c0bf8d3cc68be6770e88cb6caab4c7566171388e5892980ddbf5c
        • MD5 SHA1 SHA512 TLSH

        exit_ov.png

        • Path C:\Program Files\GM5GamingMouse\skins\exit_ov.png
        • Size 3KB
        • SHA256 be6475e4586b62a635a0eb2ddf7cbe383537ad8d6d1ac75b753e1c837276dd74
        • MD5 SHA1 SHA512 TLSH

        header2_nr.png

        • Path C:\Program Files\GM5GamingMouse\skins\header2_nr.png
        • Size 2KB
        • SHA256 fedcb0fae37293d7e16726865f09816ad23085d44e2b5f100f705c3db83a8951
        • MD5 SHA1 SHA512 TLSH

        header2_ov.png

        • Path C:\Program Files\GM5GamingMouse\skins\header2_ov.png
        • Size 2KB
        • SHA256 998d0e40b4466e091459fe2fe623324ede2f999fc8a7a95868744e8b8edf4f64
        • MD5 SHA1 SHA512 TLSH

        is-TH13L.tmp

        • Path C:\Program Files\GM5GamingMouse\skins\is-TH13L.tmp
        • Size 176KB
        • SHA256 b59fc9c10f72f6510ab7a4f98af3774ffd0f853d6a82f28ce4a66894704b9903
        • MD5 SHA1 SHA512 SSDEEP TLSH

        min_nr.png

        • Path C:\Program Files\GM5GamingMouse\skins\min_nr.png
        • Size 2KB
        • SHA256 f474dd16aea6c024429fed302e00b51faed0c0ac8e82b0fce0b2cacb10c24be3
        • MD5 SHA1 SHA512 TLSH

        min_ov.png

        • Path C:\Program Files\GM5GamingMouse\skins\min_ov.png
        • Size 2KB
        • SHA256 6447f8e7d95fee7c1125a81202e56df3694dce571e7cf1c1408179207acc843c
        • MD5 SHA1 SHA512 TLSH

        mouse_nr.png

        • Path C:\Program Files\GM5GamingMouse\skins\mouse\mouse_nr.png
        • Size 72KB
        • SHA256 7fe88b664b4621fdfd95b7b9a0dcceceed9d2a3e4aa292245338dc6a4e7f4fbc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serial_number1.png

        • Path C:\Program Files\GM5GamingMouse\skins\mouse\serial_number1.png
        • Size 3KB
        • SHA256 43007fce7761666b78b3c0ee37eaa0112a69e7917e25a4a60300bc6daeca94d7
        • MD5 SHA1 SHA512 TLSH

        serial_number2.png

        • Path C:\Program Files\GM5GamingMouse\skins\mouse\serial_number2.png
        • Size 3KB
        • SHA256 c8d118e6cd24de9dd79470d485f4ffc57e4158c8dce093892672ea569fb05ae4
        • MD5 SHA1 SHA512 TLSH

        serial_number3.png

        • Path C:\Program Files\GM5GamingMouse\skins\mouse\serial_number3.png
        • Size 3KB
        • SHA256 b4702d26017bd4d2ca1e26f928dc88d9fdc71de115154b7aead3d34ffec850ca
        • MD5 SHA1 SHA512 TLSH

        serial_number4.png

        • Path C:\Program Files\GM5GamingMouse\skins\mouse\serial_number4.png
        • Size 3KB
        • SHA256 600c436bdc88c91f5862fb995ec73882ee708acc36a0d296d87511629b146f3f
        • MD5 SHA1 SHA512 TLSH

        serial_number5.png

        • Path C:\Program Files\GM5GamingMouse\skins\mouse\serial_number5.png
        • Size 3KB
        • SHA256 44ea506fedb65eb7051ae5a46191b797eecb1acb9a307e646dbccd50a6e1eb37
        • MD5 SHA1 SHA512 TLSH

        serial_number6.png

        • Path C:\Program Files\GM5GamingMouse\skins\mouse\serial_number6.png
        • Size 3KB
        • SHA256 3d13c576a30a80e981eca1cf5c549303be6930019a9153d16bd105a4e86afaf2
        • MD5 SHA1 SHA512 TLSH

        serial_number7.png

        • Path C:\Program Files\GM5GamingMouse\skins\mouse\serial_number7.png
        • Size 3KB
        • SHA256 7b0c1baceb59e523ef81086aac7858ae0c44093a8f91be845ec6ef2228ae034f
        • MD5 SHA1 SHA512 TLSH

        serial_number8.png

        • Path C:\Program Files\GM5GamingMouse\skins\mouse\serial_number8.png
        • Size 3KB
        • SHA256 bd484905387b4d6790585b45384eb4723fbdb7c62dc365d1ae0e48f074990c5b
        • MD5 SHA1 SHA512 TLSH

        serial_number9.png

        • Path C:\Program Files\GM5GamingMouse\skins\mouse\serial_number9.png
        • Size 3KB
        • SHA256 89d48b4df7e9b9b47b72f827e1d26ef16df14edc132fb0cd549919ea07355475
        • MD5 SHA1 SHA512 TLSH

        power_manage_10min.png

        • Path C:\Program Files\GM5GamingMouse\skins\power_manage_10min.png
        • Size 15KB
        • SHA256 a4502f35a357a8d71b432fd03d9f4d65337a2d2a8292eaa8f4bf2a181c8dc751
        • MD5 SHA1 SHA512 SSDEEP TLSH

        power_manage_3min.png

        • Path C:\Program Files\GM5GamingMouse\skins\power_manage_3min.png
        • Size 16KB
        • SHA256 ff6a68263e7b8c1ada943caeadcbf440cab02c51da1bd3126097a5b72e3ab2a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        power_manage_4min.png

        • Path C:\Program Files\GM5GamingMouse\skins\power_manage_4min.png
        • Size 16KB
        • SHA256 e26858412ac07d48afc8948925c31d9fab2319af4af2cd4606f2047e1170fbde
        • MD5 SHA1 SHA512 SSDEEP TLSH

        power_manage_5min.png

        • Path C:\Program Files\GM5GamingMouse\skins\power_manage_5min.png
        • Size 16KB
        • SHA256 2a2ca88a97d04be0d228f6a8e92377963f30cc611647463173c15924a6daf304
        • MD5 SHA1 SHA512 SSDEEP TLSH

        power_manage_6min.png

        • Path C:\Program Files\GM5GamingMouse\skins\power_manage_6min.png
        • Size 16KB
        • SHA256 30df2fca304bec157f7e3d02b97d36e045a55d125f90562c976cadba98a3f83d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        power_manage_7min.png

        • Path C:\Program Files\GM5GamingMouse\skins\power_manage_7min.png
        • Size 16KB
        • SHA256 0f5f3b1ec0703ac382c4258f8dd4f757a5ac80512d37478ec2efcbb2c83b240e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        power_manage_8min.png

        • Path C:\Program Files\GM5GamingMouse\skins\power_manage_8min.png
        • Size 15KB
        • SHA256 ef46cbc31ad77d3ad598a0d6c95e717efda4e048648ac123b61240862ac2e01b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        power_manage_9min.png

        • Path C:\Program Files\GM5GamingMouse\skins\power_manage_9min.png
        • Size 15KB
        • SHA256 13a5a345d0ceed30338d25f2b5fdf3fc795677fac0d141a979ec54895f21e4ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        profile_slot_nr.png

        • Path C:\Program Files\GM5GamingMouse\skins\profile_slot_nr.png
        • Size 2KB
        • SHA256 df26d1ed036bb610817c7d41d16fd41fdd4eb7f513736b25e539a13e02f1c1a4
        • MD5 SHA1 SHA512 TLSH

        profile_slot_nr2.png

        • Path C:\Program Files\GM5GamingMouse\skins\profile_slot_nr2.png
        • Size 2KB
        • SHA256 16db02e407881ca0dadd1bc1867cf0568d21cf6d5d1a9045b3a58b4e9f0ef497
        • MD5 SHA1 SHA512 TLSH

        profile_slot_ov.png

        • Path C:\Program Files\GM5GamingMouse\skins\profile_slot_ov.png
        • Size 2KB
        • SHA256 8d04d7de1bac80641b7f644d44806c16d1209c902360162cb6039e490d64a2a7
        • MD5 SHA1 SHA512 TLSH

        unins000.exe

        • Path C:\Program Files\GM5GamingMouse\unins000.exe
        • Size 3.0MB
        • SHA256 f7e12b475da7738175f5b939fd48a141c8bfafc20c6b84687d3379025703215b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        35c9e15c876c3668d18d97f14fa6557467da508fc27ffd60f71e430a473fd28f.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-BOHO3.tmp\35c9e15c876c3668d18d97f14fa6557467da508fc27ffd60f71e430a473fd28f.tmp
        • Size 3.0MB
        • SHA256 2e4d2367e684e16378bfe52478af2f05abe8c8be2a72d0b87e8ecaaf848cd10a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LanSetting.ini

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20251202A\config\LanSetting.ini
        • Size 60B
        • SHA256 740f7d0af65a3988d40038c4a89f93de1e1dcfe2b3d6abc8170cedfd91f805ab
        • MD5 SHA1 SHA512 TLSH

        Lan_EN.txt

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20251202A\config\Lan_EN.txt
        • Size 11KB
        • SHA256 eb907c08fd6034b38745a4dc3faa348a61b2e118aef42aefa27d3deb212e9003
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MacroLibraryFile.mlf

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20251202A\config\MacroLibraryFile.mlf
        • Size 198B
        • SHA256 d0ca925d6a7f34eb2530178e681acf2b82d84bbc8ec0504f667851dbb573c65d
        • MD5 SHA1 SHA512 TLSH

        config.ini

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20251202A\config\config.ini
        • Size 1KB
        • SHA256 4a6d7c42fcf4549288c1f399fa48782c2ad70dfce3b361845ab9150c9a50d436
        • MD5 SHA1 SHA512 TLSH

        default0.psf

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20251202A\config\default0.psf
        • Size 29KB
        • SHA256 10d70e53565c834668ca39490bd4ee046e26b024d672c39ef8a4edf973adde59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default1.psf

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20251202A\config\default1.psf
        • Size 29KB
        • SHA256 a53a2e5fcfc8dfe7cafaf776edf3398e79b76747bc480f370daedf5f3b41d607
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default2.psf

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20251202A\config\default2.psf
        • Size 29KB
        • SHA256 156193f031cf22f600e0caabd15b960e980d7aaf0c0abc37334bfe04e69b26cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default3.psf

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20251202A\config\default3.psf
        • Size 29KB
        • SHA256 202acb5d6f89587e6bf67318b856640d4db4728e6109d8eeeedf81421558c62d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default4.psf

        • Path C:\Users\Admin\AppData\Roaming\GamingMouseData20251202A\config\default4.psf
        • Size 29KB
        • SHA256 fe8625a9948e32fccb4c7bed17bc0d36e31077f7d4a5a6efd201012dfe588dba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/5904-480-0x0000000000400000-0x00000000004CA000-memory.dmp

        memory/5904-8-0x0000000000400000-0x00000000004CA000-memory.dmp

        memory/5904-1-0x0000000000400000-0x00000000004CA000-memory.dmp

        memory/5988-479-0x0000000000400000-0x0000000000708000-memory.dmp

        memory/5988-403-0x0000000000400000-0x0000000000708000-memory.dmp

        memory/5988-14-0x0000000000400000-0x0000000000708000-memory.dmp

        memory/5988-12-0x0000000000400000-0x0000000000708000-memory.dmp

        memory/5988-9-0x0000000000400000-0x0000000000708000-memory.dmp

        memory/5988-10-0x0000000002880000-0x0000000002881000-memory.dmp

        memory/5988-6-0x0000000002880000-0x0000000002881000-memory.dmp