20a5787863f41cabdd209566ea50dde32124816ac51d8249b7689ff1a9f1cd40

Analysis

max time kernel
30s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lala and the Bizarre Dungeon.exe
Size 437.2MB
Sample260703-bew6aahv4s
SHA256 20a5787863f41cabdd209566ea50dde32124816ac51d8249b7689ff1a9f1cd40
MD5 04dea4bbfbb477d87a553c2c8c0679ad
SHA1 8fb65c3708c82917600bdbd2b16be28f3bc84756
SHA512 b319203e6860dee457de99a6b28d44d9269e6786ef6e12cd0753f62cf731a88097b60efcb299c92d84112f9b357868d2c8d86c25140c0ac1274efd05c63948e0
SSDEEP 6291456:uJZjiP05I2GxPpJ2j9RvI8PpJAe003sx9ixOoSDgb:Z2G4PpJA31+yD+
TLSH
T13B291220DFC4E5A7F2B874BF19A678A781DF9DA129D3E40A4A163F4778B2F181535320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4500	stdrtex.exe

Loads dropped DLL 6 IoCs

pid	Process
4500	stdrtex.exe
4500	stdrtex.exe
4500	stdrtex.exe
4500	stdrtex.exe
4500	stdrtex.exe
4500	stdrtex.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lala and the Bizarre Dungeon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stdrtex.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4500	stdrtex.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 4500	1196	Lala and the Bizarre Dungeon.exe	86

C:\Users\Admin\AppData\Local\Temp\Lala and the Bizarre Dungeon.exe
"C:\Users\Admin\AppData\Local\Temp\Lala and the Bizarre Dungeon.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\mrtA63E.tmp\stdrtex.exe
  "C:\Users\Admin\AppData\Local\Temp\mrtA63E.tmp\stdrtex.exe" /SF "C:\Users\Admin\AppData\Local\Temp\Lala and the Bizarre Dungeon.exe" /SO621568
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

INI++15.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrtA63E.tmp\INI++15.mfx
Size 439KB
SHA256 4f7e3cc575de56d815589db22a1d96760e2f309e58b9bde1a57e108bda069393
MD5 760454c677adda4b319272641680e331
SHA1 348f18fb00889c3058451c2f034b51d6965522af
SHA512 62f4d9c151adf2ce2430028185241f890849b3b0c2a11b5cc8c0e74bb3c02f3246e3abdc4031b75d2aaba9f24c26e60b165c410c2bf7c4e0569b34882b8477a7
SSDEEP 12288:COUHF5C1qTcnhwMuTwRTqGqKCspFOclh:yF5uIT0qbKCspFOc
TLSH
T141A438603690C177D57E43F23A297B1A403E7961077E98DBABC1696A38B01C25B70FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MMFS2.dll

Path C:\Users\Admin\AppData\Local\Temp\mrtA63E.tmp\MMFS2.dll
Size 768KB
SHA256 55758f6feb733e3c52bf3643a77a304ea9d813bb17c8413455b4a4f194172dea
MD5 d39a44eac8f3f3481a2c31cfb0ffdd2d
SHA1 6b6fe39511b2aa645fea955bda0e4aacb93c6795
SHA512 a4c51aa7d5ac23f02379a108f8f92775f03019252bc8167e45744de945a775fe2fbc81a319e66a0202dd1e9497602062e0089eacc746223d585166850fdf4cf6
SSDEEP 24576:6iNXe3TMN81u6NW/tb4npiyq/8UMT1as:jNXe3TMNcu6NWbCqkUMT8
TLSH
T15FF4AE20BDC5C131D6AA247286BDFBBE19AC66300BB455CB4B881E7A1F301D36F36657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmf2d3d9.dll

Path C:\Users\Admin\AppData\Local\Temp\mrtA63E.tmp\mmf2d3d9.dll
Size 1.5MB
SHA256 bddda991185a9e83b9855a109f2fcfa78cd2d5402e9db344c6ec77f6ce69a0c5
MD5 c85bcc9f3049b57aa8ccbb290342ff14
SHA1 38f5b81a540f1c995ff8d949702440b70921acc5
SHA512 5097f9d78ddc651aabf41f217f622ee656a1c6de6a9b339354525293102cf631cca2b7babaf991e99e49efe4d1bb6792c8a7a11f82e4ae2081c3961eb9b5afe7
SSDEEP 24576:rYhBOKa6c8DVYrsz0LbMgPqgVmpiLfmVydmN/9KcAfcLacioayK:v6FjILIgigQrye8cqua5
TLSH
T1CC75BF11B681C036C4B73231065EA37562BDAF211A7495CF17883E7A7F745E2AB3829F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmfs2.txt

Path C:\Users\Admin\AppData\Local\Temp\mrtA63E.tmp\mmfs2.txt
Size 588B
SHA256 003f2436b44e36ef4df5faa349ee9188c10af279332fa935c91810e648f87791
MD5 bb50443d2980752e88c2b32c18eb9da8
SHA1 2d8258484c4d576d7cde305debd5447e737ed096
SHA512 fb2235ed42d36585478746b75f556f46e085a7778cdf47e9ab9f945f978e51966e2a72388567834bcc4ef1371ea0634b89406d3ff5eb0305e21ac363ba46cc07
TLSH
T1DEF04C2FFFC5029A451457B0463C86C5C90B4F2CF594BC293CD9E70AE91CA1E2903D74
MD5 SHA1 SHA512 TLSH

Submit Download

oggflt.sft

Path C:\Users\Admin\AppData\Local\Temp\mrtA63E.tmp\oggflt.sft
Size 130KB
SHA256 9e589f86317d840df9bb74f6ee20c24ca65afe58f4009740382f63a0f5531941
MD5 0c8c1ee3ba92189f4ce21d1b396a2765
SHA1 b7daa4a6e16416151dccbb0a89f304961b6cb627
SHA512 0a4339092ac55bac3b1bdfaaa3401020f8f49918bd2fdb14524f3d558eb840b876aedfdeb54a1da163fa36393abf3fe8ab7e112a34ea9d891e82a22e96c85ddc
SSDEEP 1536:Ww+JHBmul5IMIPkmLnFfUs3OF+KQ51PGTUBHnEJj0AtDLPJwdMSIiRaEUsXxTTUI:CCul5jEkSbOF+31PGTUBwoA8uMR0IjD
TLSH
T142D39E529687A0FEE8CE1978146F367FDE261A0D7218CD539314EEF69C61E10BE1930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stdrtex.exe

Path C:\Users\Admin\AppData\Local\Temp\mrtA63E.tmp\stdrtex.exe
Size 1.3MB
SHA256 93b2a50374865ee2c791ef50f05ed84f24ed79ce7a3270d8c4e66b410fef6f95
MD5 b22fc7eedd5038265d619f9a960f58fc
SHA1 494a51da73c1a76cb7fcf5e30577b190ad9c343b
SHA512 53f1780f154a6471b16da90cd551cc1412ab66dc82f3436d4589f7cada49194b4b0dc289edc745a86d1e5da9620e155a1c242bd050f9b1e93eb870503f38fbb5
SSDEEP 12288:HcKnHuyagVQYOJm5qSVa+aDuj2C+uVUXTIhBpqS67wEeIK1R8/SL2h9cNnsKSteM:HO8OnSEPu2ejNnTUe3QZGYDMAY
TLSH
T14E55F650E4C9B125D991BCF14A79AA3617694C231B3C20C3CE846B289BFF4D16E7F52E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

waveFlt.sft

Path C:\Users\Admin\AppData\Local\Temp\mrtA63E.tmp\waveFlt.sft
Size 8KB
SHA256 92a5053cf5973a6aa228c738d55387f12f1dfa8a837d7b938c60f05b6b56b3ad
MD5 57ea61dd14314ef155e80c6a0be8a664
SHA1 963b0ef2fe976ff77044a821fe1e29be4a8cf8a7
SHA512 cc23cb30d76d22500c3ed7ce9ee0388588309d0779441b95559fce25a42f1eff52ca285c347655f8b33c15b75f9d2067738a151f81f605d3b563799a3a06c9a9
SSDEEP 96:vLor1Jnr+4O1tLj+Ct2KTOGTrgHchhAfETVdnPstJgxl8V6N/8cKH+ewp:v26Dj9t2ubTVdGJgOcGvw
TLSH
T16FF11B12A7A500F5F8DD0B7134B7627BE875FA285B11C24FC580DE6C0C301E2D928BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4500-17-0x0000000074BD0000-0x0000000074C95000-memory.dmp

Download

memory/4500-19-0x0000000074BD0000-0x0000000074C95000-memory.dmp

Download

memory/4500-16-0x0000000074BD0000-0x0000000074C95000-memory.dmp

Download

memory/4500-15-0x0000000074BD0000-0x0000000074C95000-memory.dmp

Download

memory/4500-18-0x0000000074BD0000-0x0000000074C95000-memory.dmp

Download

memory/4500-14-0x0000000074BD0000-0x0000000074C95000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads