Overview
overview
10Static
static
5EXITLAG_PA....4.zip
windows10-2004-x64
10EXITLAG_PA....4.zip
windows11-ltsc_2024-x64
8EXITLAG_PA...on.bat
windows10-2004-x64
1EXITLAG_PA...on.bat
windows11-ltsc_2024-x64
1EXITLAG_PA....4.exe
windows10-2004-x64
10EXITLAG_PA....4.exe
windows11-ltsc_2024-x64
10EXITLAG_PA...rt.exe
windows10-2004-x64
10EXITLAG_PA...rt.exe
windows11-ltsc_2024-x64
10EXITLAG_PA...ow.dll
windows10-2004-x64
1EXITLAG_PA...ow.dll
windows11-ltsc_2024-x64
1EXITLAG_PA...pi.dll
windows10-2004-x64
1EXITLAG_PA...pi.dll
windows11-ltsc_2024-x64
8EXITLAG_PA...fig.db
windows10-2004-x64
3EXITLAG_PA...fig.db
windows11-ltsc_2024-x64
3EXITLAG_PA...s2.bin
windows10-2004-x64
3EXITLAG_PA...s2.bin
windows11-ltsc_2024-x64
8EXITLAG_PA...64.dll
windows10-2004-x64
1EXITLAG_PA...64.dll
windows11-ltsc_2024-x64
1EXITLAG_PA...rl.dll
windows10-2004-x64
1EXITLAG_PA...rl.dll
windows11-ltsc_2024-x64
8EXITLAG_PA...e3.dll
windows10-2004-x64
1EXITLAG_PA...e3.dll
windows11-ltsc_2024-x64
8EXITLAG_PA...b1.dll
windows10-2004-x64
1EXITLAG_PA...b1.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
898s - max time network
545s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/07/2026, 02:14
Static task
static1
Behavioral task
behavioral1
Sample
EXITLAG_PATCHER_V1.4.4.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
EXITLAG_PATCHER_V1.4.4.zip
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
EXITLAG_PATCHER_V1.4.4/Exception.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
EXITLAG_PATCHER_V1.4.4/Exception.bat
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral5
Sample
EXITLAG_PATCHER_V1.4.4/ExitLagCrackV1.4.4.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
EXITLAG_PATCHER_V1.4.4/ExitLagCrackV1.4.4.exe
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral7
Sample
EXITLAG_PATCHER_V1.4.4/FirstStart.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
EXITLAG_PATCHER_V1.4.4/FirstStart.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
EXITLAG_PATCHER_V1.4.4/Slow.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
EXITLAG_PATCHER_V1.4.4/Slow.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral11
Sample
EXITLAG_PATCHER_V1.4.4/api.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
EXITLAG_PATCHER_V1.4.4/api.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
EXITLAG_PATCHER_V1.4.4/config.db
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
EXITLAG_PATCHER_V1.4.4/config.db
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
EXITLAG_PATCHER_V1.4.4/definitions2.bin
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
EXITLAG_PATCHER_V1.4.4/definitions2.bin
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral17
Sample
EXITLAG_PATCHER_V1.4.4/ibcrypto-3-x64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
EXITLAG_PATCHER_V1.4.4/ibcrypto-3-x64.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
EXITLAG_PATCHER_V1.4.4/libcurl.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
EXITLAG_PATCHER_V1.4.4/libcurl.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
EXITLAG_PATCHER_V1.4.4/sqlite3.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
EXITLAG_PATCHER_V1.4.4/sqlite3.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
EXITLAG_PATCHER_V1.4.4/zlib1.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
EXITLAG_PATCHER_V1.4.4/zlib1.dll
Resource
win11ltsc2024-20260709-en
General
- Target EXITLAG_PATCHER_V1.4.4/definitions2.bin
- Size 1.8MB
- Sample260716-cn9y6sbs8j
- SHA256 3da83bf8a0b9ce69e1659be775a7581ff1cd6ee7745a562b9bf0b2d347a9b009
- MD5 c2c8a9d4d3f2d44a50ec1ff682838cc3
- SHA1 532a8c11e770c5da8927e5b5bd257bc59a857e0e
- SHA512 e5ba3887c75521832c15c772141c23155dbe85979f34f152e5c7b812d489fb212725b2a577239d8ab372df60ea6c51ef0968d185b394eda8b0c29a43bc820935
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1824 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\EXITLAG_PATCHER_V1.4.4\definitions2.bin1⤵
- Modifies registry class
PID:3880
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1824