ababd93e9650eaa5ee657813bc9e33515dd10acc5a900592bb1ba36b6a3165fa

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
droidkit-en-setup.exe
Size 19.5MB
Sample260705-pdefqsct4v
SHA256 ababd93e9650eaa5ee657813bc9e33515dd10acc5a900592bb1ba36b6a3165fa
MD5 3b4ff04796f2bd07cd66e7a54b13cbcd
SHA1 fda04c4d26b0fbb5553e737aae84841ae2641dc6
SHA512 d1c0f85a2befe25d909d8ff647bd39e88e01b887ce33cf98b4c9970ff870b47a53557dd617842338c783e31d6416f00fedf7e0b3315708f92389f1adb7a7a2e4
SSDEEP 393216:6F4pwiT6tDIpXmu1oxXqL5WV+cUIsBws6XYbTkrXDTNiDRUGJwPAEWXq:6LimapXmEoOkDYUX3NiDRUGJ2Y6
TLSH
T1DF273365E7D545AFDEA058B6C3B3A6C2C8B59E300C380D52F8CC3B9B183B7591B612D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	droidkit-en-setup.exe

Loads dropped DLL 8 IoCs

pid	Process
564	droidkit-en-setup.exe
564	droidkit-en-setup.exe
564	droidkit-en-setup.exe
564	droidkit-en-setup.exe
564	droidkit-en-setup.exe
564	droidkit-en-setup.exe
564	droidkit-en-setup.exe
564	droidkit-en-setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	droidkit-en-setup.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	droidkit-en-setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	droidkit-en-setup.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 4260	564	droidkit-en-setup.exe	85
PID 4260 wrote to memory of 2712	4260	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\droidkit-en-setup.exe
"C:\Users\Admin\AppData\Local\Temp\droidkit-en-setup.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"dk-Windows\",\"user_id\":\"49B9A52D\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Launch App\",\"el\":\"1\",\"pv\":\"dk-win\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"1.0.1.2\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-VR4P911QVY&api_secret=RrQJtReGS520apjVhJz5xw""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SysWOW64\curl.exe
    curl -X POST -H "Content-Type: application/json" -d "{\"client_id\":\"dk-Windows\",\"user_id\":\"49B9A52D\",\"events\":[{\"name\":\"Install_SW\",\"params\":{\"engagement_time_msec\":\"1\",\"ea\":\"Launch App\",\"el\":\"1\",\"pv\":\"dk-win\",\"install_productversion\":\"Official-com\",\"install_trackversion\":\"1.0.1.2\",\"soft_os_version\":\"Windows_64\"}}]}" "https://www.google-analytics.com/mp/collect?measurement_id=G-VR4P911QVY&api_secret=RrQJtReGS520apjVhJz5xw"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CheckProVs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjF00.tmp\CheckProVs.dll
Size 7KB
SHA256 ee7e26894cbf89c93ae4df15bdb12cd9a21f5deacedfa99a01eefe8fa52daec2
MD5 62e85098ce43cb3d5c422e49390b7071
SHA1 df6722f155ce2a1379eff53a9ad1611ddecbb3bf
SHA512 dfe7438c2b46f822e2a810bc355e5226043547608d19d1c70314e4325c06ad9ad63a797905e30d19f5d9a86ee1a6d9c28f525a298731e79dbf6f3d6441179a8e
SSDEEP 96:iqCVh8iNqVgRudZczLiJp2tvgaJOnT/323x3XQUPVAm6yBBECtu7ZyvN:9IhJqUudZkLi+bOni3x3X3PVR6yBBfj
TLSH
T19BF14B36F68A80B2D66C01FA1E62512E475C77631BA241F77B9A03DA1E948D5FC30366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleTracingLib.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjF00.tmp\GoogleTracingLib.dll
Size 36KB
SHA256 ad873f1e51e6d033e5507235ec735957256ebeeb0d3f22aa0b57bb4bd0846e4c
MD5 d8fca35ff95fe00a7174177181f8bd13
SHA1 fbafea4d2790dd2c0d022dfb08ded91de7f5265e
SHA512 eb530b10f137cb0cdfdcd2c11fd9f50f774e0ce44e9d2da3e755f6a6df24fe6e7525c27b109e3e68e9d3e49a889937a22f4d9d78703b1055a83b8a58808a58ba
SSDEEP 768:IWXV2fVEC5h9KclMCumc6plPHY4jq7rOZkdhKZV:8Smh9/BumTlg4kOZ+Kz
TLSH
T10EF23A21770884B2C19F13B2787A671AD72CAA960FE257D3B7A796BD0D702E35473603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjF00.tmp\System.dll
Size 11KB
SHA256 df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
MD5 ca332bb753b0775d5e806e236ddcec55
SHA1 f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA512 2de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
SSDEEP 192:eo24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol6Sl:k8QIl975eXqlWBrz7YLOl6
TLSH
T1C3325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE20BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp100.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjF00.tmp\msvcp100.dll
Size 593KB
SHA256 934d882efd3c0f3f1efbc238ef87708f3879f5bb456d30af62f3368d58b6aa4c
MD5 d029339c0f59cf662094eddf8c42b2b5
SHA1 a0b6de44255ce7bfade9a5b559dd04f2972bfdc8
SHA512 021d9af52e68cb7a3b0042d9ed6c9418552ee16df966f9ccedd458567c47d70471cb8851a69d3982d64571369664faeeae3be90e2e88a909005b9cdb73679c82
SSDEEP 12288:koBFUsQ1H5FH3YUTd/df0RA7XkNvEKZm+aWodEEiblHN/:dFUsQ1H5FHdGKkNvEKZm+aWodEEcHN/
TLSH
T149D41A23FB2906B0E162D37C65D6C341D3F13C8A4B22A7C752ABD52D2F276D9567B220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjF00.tmp\msvcr100.dll
Size 809KB
SHA256 ae3cb6c6afba9a4aa5c85f66023c35338ca579b30326dd02918f9d55259503d5
MD5 366fd6f3a451351b5df2d7c4ecf4c73a
SHA1 50db750522b9630757f91b53df377fd4ed4e2d66
SHA512 2de764772b68a85204b7435c87e9409d753c2196cf5b2f46e7796c99a33943e167f62a92e8753eaa184cd81fb14361e83228eb1b474e0c3349ed387ec93e6130
SSDEEP 12288:QgzGPEett9Mw9HfBCddjMb2NQVmTW75JfmyyKWeHQGoko+1:HzJetPMw9HfBCrMb2Kc6dmyyKWewGzB1
TLSH
T181059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDui.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjF00.tmp\nsDui.dll
Size 10.0MB
SHA256 3be54dea5aedc0d8d16d6c4bd4e046e2d93bfc550a1a035a94768c2d5901e327
MD5 368841af8b0074e348418f106716e603
SHA1 75469510665b651b38e3b4fb7c4240722c756126
SHA512 3804afa3930a90f258a2b4e7106e1d0211e5d4ca6a7f5ba23da11e3908b4e202295ddbcb1ecf1e15215bc9a0aece1a46efad07ad94feddd4f316b0de674c50d5
SSDEEP 196608:H1YWSpeHkab9WLMhJuH9E7QfqV9BgtBx2Tr+Z/iYyEuOyWoqeob8VvW:eWBfbQcJudLqV9ByBxP/1o0b
TLSH
T162B6235266D201B5CA5B823A5B386B747C6DB1206771C1CF73DACA1B086AAE4C6353F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads