a59bb85b74832a7aaee6c4cfd2383f03a64a1ba06a442cc5a51dca559bcdae75

Analysis

geolocation tags

asiadelhiinindia
max time kernel
299s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PacMan.exe
Size 4.3MB
Sample260714-ecf8tsfz8v
SHA256 a59bb85b74832a7aaee6c4cfd2383f03a64a1ba06a442cc5a51dca559bcdae75
MD5 cff7fab474e2cf33b332210af5608fd7
SHA1 79a7fcf6b799f70e2389ce04a669d55b96f022f9
SHA512 c01d4febd32db5c085534073096d9816182ef3b0c198eadd640959ad20d1a9489dd94a2529e872319f41c7175fb550eccca25d7adae80ddae9df79b97e8d6e80
SSDEEP 49152:iK+g+FAl5LYVNJ1IVuEWiVFDFodj9Kb54VPnpbsEKa86IWSCiMuiR8ZrgeFKiLpa:b+FUSJ1xEWCFxofKb6pbcZd1g3XDj
TLSH
T1EA2633432ABE819EE8224B705A3CC55740B1FCAA1FD9A11F2688FD7B1BF57804531E97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4476	PacMan CRT.exe

Loads dropped DLL 1 IoCs

pid	Process
4476	PacMan CRT.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	PacMan.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PacMan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PacMan CRT.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4476	PacMan CRT.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 4476	1244	PacMan.exe	87

C:\Users\Admin\AppData\Local\Temp\PacMan.exe
"C:\Users\Admin\AppData\Local\Temp\PacMan.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PacMan CRT.exe
  "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PacMan CRT.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PacMan CRT.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PacMan CRT.exe
Size 3.2MB
SHA256 844a6e4bd55fb7c88ab476734a2180e70d2298e20c0ea4b23d94f29f75fcaca2
MD5 cbf5f66f38d503f4f38ff6a1601f3f4d
SHA1 c8380f461d12fed0e4ac3c2376b7f4d9660e27ad
SHA512 7994bc7c16713499377889640be6b4187b43aff761c4507f30777aca800cc1eaea9af3c8a872e921e5dd89339618332f50cf7564c0d1816573b0b2bf48b98263
SSDEEP 49152:Vy57CjUJir1NaVCK2n7nZOCk7bAOcaZorItMPTYQ:skJrv3n7nZOD7bAOc7rItMkQ
TLSH
T126F58D407281D0B1E44161F8ACAAD6AF46267F65873895DFB7D03F1A9B736E01E732C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dx9_43.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3dx9_43.dll
Size 1.9MB
SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
MD5 86e39e9161c3d930d93822f1563c280d
SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
TLSH
T14895AF51C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB8BE1EAB8387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.win

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\data.win
Size 2.9MB
SHA256 53aeff59d147aefd3b43bb07ee5711de2d5224302c7bfd10b83a99e9cd73db31
MD5 3267bfd83d96c89ff1989c582787f1e4
SHA1 1b607bd60a8ff2b8b6c7987401f0276a87da6f73
SHA512 140f2ba89205b68a47424e01e898a4fc022898453d6a6ead51b01270a1bfb4e2c1666460a67b5a99505b03cf0308647f1254ed357f8f49031868bb23208cf458
SSDEEP 49152:5NiB33n/J/u9FEINHb+NFx9wgZz00eiouAKKzCkfPMIcFy96fMj0tN1:ziBfJGDHb+NlwYg0PouAIMPMHFBEjSN1
TLSH
T129E5DF23B542D98EC05256364C42EED819B3BD14EF98424732F5FF6FBA36240A8DF646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads