Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/07/2026, 13:12
General
- Target Red-Gate.Multi.Keygen.RePT.exe
- Size 1.5MB
- Sample260716-qfvfeah18z
- SHA256 d3e9558e433828f64c899e51d8cd457f899f6a65cdd0577bd0d760e54ce038c4
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Red-Gate.Multi.Keygen.RePT.exe"C:\Users\Admin\AppData\Local\Temp\Red-Gate.Multi.Keygen.RePT.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Bass.Net.dll
Bass.dll
memory/4240-4-0x0000000006AA0000-0x000000000705A000-memory.dmp
memory/4240-9-0x0000000073F40000-0x00000000746FC000-memory.dmp
memory/4240-0-0x0000000000E30000-0x0000000001426000-memory.dmp
memory/4240-5-0x0000000006580000-0x0000000006612000-memory.dmp
memory/4240-6-0x0000000006520000-0x000000000652A000-memory.dmp
memory/4240-7-0x0000000006680000-0x00000000066D6000-memory.dmp
memory/4240-8-0x0000000073F40000-0x00000000746FC000-memory.dmp
memory/4240-3-0x0000000006440000-0x00000000064DC000-memory.dmp
memory/4240-18-0x0000000009690000-0x0000000009722000-memory.dmp
memory/4240-2-0x0000000000E30000-0x0000000001426000-memory.dmp
memory/4240-1-0x0000000073F52000-0x0000000073F53000-memory.dmp
memory/4240-32-0x0000000011000000-0x000000001104C000-memory.dmp
memory/4240-34-0x0000000000E30000-0x0000000001426000-memory.dmp
memory/4240-36-0x0000000011000000-0x000000001104C000-memory.dmp
memory/4240-37-0x0000000073F52000-0x0000000073F53000-memory.dmp
memory/4240-38-0x0000000073F40000-0x00000000746FC000-memory.dmp