654c3ab2df68837b8c381227438dda4ad6e7d4f5d5900e1cc397f4d454d45b6b

Analysis

max time kernel
6s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ML_Sound_Lab_Amped_-_Stevie_T_1.0.2_WiN_[MOCHA].exe
Size 8.1MB
Sample260709-e8byzscw6n
SHA256 654c3ab2df68837b8c381227438dda4ad6e7d4f5d5900e1cc397f4d454d45b6b
MD5 58e31eefe8d73c6c9b769724845936b5
SHA1 936a541e478c2660c76bd5e6d22b336faeca0e65
SHA512 9c2896d5f4e2e9a8f70e30686fa1352ed9626eb6a879cfff9877ba8dfe6e7c850f5acff8d7fdeeef8892a28a7c83aa162d45777c9242751c0b6548a4afa94ff5
SSDEEP 196608:ssirwtQwtjAAFW4BpusjdrKTrDHvJFhntlmlTjTbD+QPhGeYS:2rwtQwq4HhdCrqTjznPhGlS
TLSH
T12286123F7268A13EC86A0BB159B3C2944B777A90745A8C1AC7F8444CCB767601E3E677
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2024	ML_Sound_Lab_Amped_-_Stevie_T_1.0.2_WiN_[MOCHA].tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ML_Sound_Lab_Amped_-_Stevie_T_1.0.2_WiN_[MOCHA].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ML_Sound_Lab_Amped_-_Stevie_T_1.0.2_WiN_[MOCHA].tmp

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2328-0-0x0000000000400000-0x00000000004E9000-memory.dmp	innosetup

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2024	2328	ML_Sound_Lab_Amped_-_Stevie_T_1.0.2_WiN_[MOCHA].exe	88

C:\Users\Admin\AppData\Local\Temp\ML_Sound_Lab_Amped_-_Stevie_T_1.0.2_WiN_[MOCHA].exe
"C:\Users\Admin\AppData\Local\Temp\ML_Sound_Lab_Amped_-_Stevie_T_1.0.2_WiN_[MOCHA].exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\is-6LGJS.tmp\ML_Sound_Lab_Amped_-_Stevie_T_1.0.2_WiN_[MOCHA].tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6LGJS.tmp\ML_Sound_Lab_Amped_-_Stevie_T_1.0.2_WiN_[MOCHA].tmp" /SL5="$901F4,7651232,898560,C:\Users\Admin\AppData\Local\Temp\ML_Sound_Lab_Amped_-_Stevie_T_1.0.2_WiN_[MOCHA].exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ML_Sound_Lab_Amped_-_Stevie_T_1.0.2_WiN_[MOCHA].tmp

Path C:\Users\Admin\AppData\Local\Temp\is-6LGJS.tmp\ML_Sound_Lab_Amped_-_Stevie_T_1.0.2_WiN_[MOCHA].tmp
Size 3.1MB
SHA256 e90d9065f92e8e73748386e7081f115ee7e084f753f67cb593efc1eda9ba2c90
MD5 860a78d495366585d8284fc6783fc693
SHA1 e69f1c8f13a176c6e1294792d38f950846dbc7ae
SHA512 7995d718ea2b09bb671c92d95e61deeef13cc394b76d415dd407b283a6b9165d21007f4185fee42f709f79602d964c9132158ddb941954fe9d842243c9e16c31
SSDEEP 49152:nWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbW333+7pkH:JtLutqgwh4NYxtJpkxhG5333+a
TLSH
T127E55B27F288B13EC46B3B714A73C1949937F66179128C2797FC780C8E366942A3E657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2024-6-0x0000000002740000-0x0000000002741000-memory.dmp

Download

memory/2328-0-0x0000000000400000-0x00000000004E9000-memory.dmp