Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 14:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
O2HdKrkkcy.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
O2HdKrkkcy.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target O2HdKrkkcy.exe
- Size 22.7MB
- Sample260702-rh2syacz2k
- SHA256 5a2f65ad4b61d3b6cee20e8b89d100d1a051b25a655692dec0f777ff9e598c9d
- MD5 d1a2e69d10ca0c7695e8b0e7871479c6
- SHA1 140408dc1ec7acd3eeb0c22e0bf8adbe72cdff93
- SHA512 460efc285aa915778cdf62699440823f975ebe822078674e2fd339fe2e38788731dcf0eb3575dca6529ad1708aaf636bef1a8a8078fdabace4be1fd3a4182d56
- SSDEEP 393216:1/NaoPL5Y8V0HruFKuXbmKHL+iyr7xaE8SBVIvr8UdpoqEpLOoAdSpv:1/NaouruguXbmgGr7jNevr8UxEvAdS
- TLSH T1943723E158D816F4F3E74B04C1C7224FA3923677DF96EA0D16C49C031A62E979A46F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\System32\D3DGear64.dll O2HdKrkkcy.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe 2608 O2HdKrkkcy.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 2608 O2HdKrkkcy.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2608 wrote to memory of 2696 2608 O2HdKrkkcy.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\O2HdKrkkcy.exe"C:\Users\Admin\AppData\Local\Temp\O2HdKrkkcy.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2696
-