Overview
overview
7Static
static
3exc.exe
windows10-ltsc_2021-x64
7exc.exe
windows11-ltsc_2024-x64
7ShaderZone.exe
windows10-ltsc_2021-x64
7ShaderZone.exe
windows11-ltsc_2024-x64
1resources/elevate.exe
windows10-ltsc_2021-x64
3resources/elevate.exe
windows11-ltsc_2024-x64
3$R0/Uninst...ne.exe
windows10-ltsc_2021-x64
7$R0/Uninst...ne.exe
windows11-ltsc_2024-x64
7General
- Target exc.exe
- Size 58.2MB
- Sample260708-pb49dags4l
- SHA256 4fda90856a7faa3f10b463bc841c15dac0e1aad707512c5631086ee2758b8d40
- MD5 52cefd1020d95d1c5093b91a27ee9428
- SHA1 16855306d23b609f0ea1e5bb8dd79d365408c932
- SHA512 1265d01a812232b746e48899b0f6f2cbcce824adad04317f1df16817590af70eaa885e2296fa461965b81d40c805d8f7e0e3f7b63b529e77a6585a4541a4cd4b
- SSDEEP 1572864:wNHVlr4oHixTZ0Fep65N3b/qu4FkylvbKcSHtXNiBRic:wRVlBHixVYo65d/qu4llvbKcSHtX4L
- TLSH T1D1D733F1325DF057E8F44A7B1182E5757B8D3E3C20A14A6132BBBE6C4A3C41D1899BE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
exc.exe
Resource
win10ltsc2021-20260513-en
Behavioral task
behavioral2
Sample
exc.exe
Resource
win11ltsc2024-20260706-en
Behavioral task
behavioral3
Sample
ShaderZone.exe
Resource
win10ltsc2021-20260513-en
Behavioral task
behavioral4
Sample
ShaderZone.exe
Resource
win11ltsc2024-20260706-en
Behavioral task
behavioral5
Sample
resources/elevate.exe
Resource
win10ltsc2021-20260513-en
Behavioral task
behavioral6
Sample
resources/elevate.exe
Resource
win11ltsc2024-20260706-en
Behavioral task
behavioral7
Sample
$R0/Uninstall ShaderZone.exe
Resource
win10ltsc2021-20260513-en
Behavioral task
behavioral8
Sample
$R0/Uninstall ShaderZone.exe
Resource
win11ltsc2024-20260706-en
Malware Config
Targets
-
- Target exc.exe
- Size 58.2MB
- SHA256 4fda90856a7faa3f10b463bc841c15dac0e1aad707512c5631086ee2758b8d40
- MD5 52cefd1020d95d1c5093b91a27ee9428
- SHA1 16855306d23b609f0ea1e5bb8dd79d365408c932
- SHA512 1265d01a812232b746e48899b0f6f2cbcce824adad04317f1df16817590af70eaa885e2296fa461965b81d40c805d8f7e0e3f7b63b529e77a6585a4541a4cd4b
- SSDEEP 1572864:wNHVlr4oHixTZ0Fep65N3b/qu4FkylvbKcSHtXNiBRic:wRVlBHixVYo65d/qu4llvbKcSHtX4L
- TLSH T1D1D733F1325DF057E8F44A7B1182E5757B8D3E3C20A14A6132BBBE6C4A3C41D1899BE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target ShaderZone.exe
- Size 125.0MB
- SHA256 2792032f8e8f9744c750a98fa37f23752319af59631c723a3ed27e43e95f8a31
- MD5 bdbde6fc0a79f2ed0960576abc8c9721
- SHA1 5320a897f3ee14d0af08750fa8549a04c556076b
- SHA512 0a3a77eeb034c009e7a60b682c8d3050c5b5b981fe912f5b0e40c4195e85359907f3caa5e215f7a4f619b495e7cf24eab7332458c225118682b3bcfe61f01147
- SSDEEP 1572864:XgHsrD2MoMg3MxuD1whA4n+eeQWGKu4dYscEWuiLhUFhcWK2H:XwmylD1w64nk54bqT
- TLSH T1F7588D03F2A610DDE05CD1769B4A8636DEB1B8464735A2DF269127162F7BFE02B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $R0/Uninstall ShaderZone.exe
- Size 483KB
- SHA256 7f0a18080f42d2eb56e821e0483ac21412b8cbf479d488aac04c560578c05805
- MD5 9ec604470136e5f8637c8f5f34adc9b6
- SHA1 6a53d72c6069b3f02c1eeddb53b121216ec44164
- SHA512 7e80d0643d7284de6e75cd21576945df471414dd082d3fcc24a9202d0ed4bf4b779a880afd864180b671df54199ceff9f5aea47eec0b3b4973e36f297d251ce8
- SSDEEP 3072:Zn77v00hEoDEtauxCeuNy4avRvPqQ2fwLaH2tvhOEA1RJCir86SrSrv6Ia3o:Z740IIQf5vL2fwLs2t0EyL+yaY
- TLSH T129B469D276FCC012D4B31B734BA982B6B761BD3D5C148E437788BF5E297DDA1881A620
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL