Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 06:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9981c36b440406797893d203bbdf98fb7991e7c0b3ff1eb897541c4054c7c309.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
General
- Target 9981c36b440406797893d203bbdf98fb7991e7c0b3ff1eb897541c4054c7c309.exe
- Size 1.5MB
- Sample260716-hdlfqaat31
- SHA256 9981c36b440406797893d203bbdf98fb7991e7c0b3ff1eb897541c4054c7c309
- MD5 01237aee4dd39844f0272b90fbba67c1
- SHA1 616fe9748aac996e6a2fb9e251aaee531c2fc084
- SHA512 2f3b51c94d0b1d51a0013b3e0d08a2a0893b07c22764107391ff7c30bb63869dd09d7b672a27c5a53e2c38c6af402a98b545a50e3e8b282b240168c942fcb261
- SSDEEP 24576:b89sf/EtSIGRurwg4lkreRo7lG4uRwlkB0JMWbzOXTphFzD:b89SEt7rwtklG4Qz6fcND
- TLSH T125759E81B6A2C0F3C1111530CCAA7BF99A319F96DE128BC7E760FE2D7C727819627159
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000e000000019ca9-3.dat acprotect - Loads dropped DLL 1 IoCs
pid Process 720 9981c36b440406797893d203bbdf98fb7991e7c0b3ff1eb897541c4054c7c309.exe -
resource yara_rule behavioral2/files/0x000e000000019ca9-3.dat upx behavioral2/memory/720-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/720-9-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/720-10-0x0000000010000000-0x000000001003E000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9981c36b440406797893d203bbdf98fb7991e7c0b3ff1eb897541c4054c7c309.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 720 9981c36b440406797893d203bbdf98fb7991e7c0b3ff1eb897541c4054c7c309.exe 720 9981c36b440406797893d203bbdf98fb7991e7c0b3ff1eb897541c4054c7c309.exe 720 9981c36b440406797893d203bbdf98fb7991e7c0b3ff1eb897541c4054c7c309.exe 720 9981c36b440406797893d203bbdf98fb7991e7c0b3ff1eb897541c4054c7c309.exe 720 9981c36b440406797893d203bbdf98fb7991e7c0b3ff1eb897541c4054c7c309.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9981c36b440406797893d203bbdf98fb7991e7c0b3ff1eb897541c4054c7c309.exe"C:\Users\Admin\AppData\Local\Temp\9981c36b440406797893d203bbdf98fb7991e7c0b3ff1eb897541c4054c7c309.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:720
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Skin.dll
- Size 86KB
- SHA256 e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1
- MD5 114054313070472cd1a6d7d28f7c5002
- SHA1 9a044986e6101df1a126035da7326a50c3fe9a23
- SHA512 a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522
- SSDEEP 1536:0OYdF5pkapU0uz96DjsVgsIm65HPdOMpFQEMqUktZcNqLODRv7zFpl91nouy8jg:0HDp7pRuKjsir5HZFQGrsUwF7hplPouG
- TLSH T1838302C6EF320EBEF80B4FB405C77A4D6661B8587339AF126E4140B4D0B3959D25ABA1
- MD5 SHA1 SHA512 SSDEEP TLSH