Analysis

  • max time kernel
    160s
  • max time network
    186s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/07/2026, 22:29

General

  • Target
    Angry Goy.exe
  • Size 666.2MB
  • Sample260721-2d99mastfx
  • SHA256 6fa2e70f90f032efe6903e9dc0f71d4af8bd21c6ce3c97dff71af0562addca66
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 33 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Angry Goy.exe
    "C:\Users\Admin\AppData\Local\Temp\Angry Goy.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2624

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        KcArray.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\KcArray.mfx
        • Size 32KB
        • SHA256 16f507da7814a6105122cbc5a881ee558dafdcd0edc57dcdbce6798aa9dd68ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Layer.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\Layer.mfx
        • Size 121KB
        • SHA256 dc282ade390ae5bb7249595adac896d2436cf0eea5c63f31e44122173dc96daf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StaticText.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\StaticText.mfx
        • Size 28KB
        • SHA256 edb5e1c739e0bfee6e277c31230a59d45ac4da80b339f601bf454d4c620a8017
        • MD5 SHA1 SHA512 SSDEEP TLSH

        adshow.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\adshow.mfx
        • Size 40KB
        • SHA256 c05b7b5fe45a20106ba776eec22dcbb606422edcae00942968cfd1f61046fc4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        aviflt.ift

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\aviflt.ift
        • Size 24KB
        • SHA256 0eeffe2fa3c93f3ef62ec357b481d6caac0d3d190fb997ebea623dc5fd674f8c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bmpflt.ift

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\bmpflt.ift
        • Size 24KB
        • SHA256 b7eb74b793f9fb30439e54af504eefee675e73ec8342bd1be784225ded98cdf4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ctrlx.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\ctrlx.mfx
        • Size 44KB
        • SHA256 3407eb12f6bacec5ebd4df96ff3fd34741a3919fd46c2ec527364c5f1e753a65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fliflt.ift

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\fliflt.ift
        • Size 28KB
        • SHA256 4fff120c0c69c1c853cbb5ff83f16a199bc2e4f45c6f8c564b22c3c10b546732
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gifflt.ift

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\gifflt.ift
        • Size 28KB
        • SHA256 4aa6628517c02816f033d79d386d7d817e7df74fe8cfae351312069fd4c61471
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jpgflt.ift

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\jpgflt.ift
        • Size 92KB
        • SHA256 23a54d3586092ccd82bc42bdab0c5ece75f68d1f6313e717a815746b38a7f857
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kcedit.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\kcedit.mfx
        • Size 32KB
        • SHA256 1945087c937b62ff8eb1999e7dbd0f19e8fa65f774575da89193cb69dc01cb9b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kcfile.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\kcfile.mfx
        • Size 36KB
        • SHA256 daa25c6b2633009f655c0ea0503602ea220f9a5788e3ac7ca11c209be3246333
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kcpica.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\kcpica.mfx
        • Size 32KB
        • SHA256 0b53a54be890422520b1482eeda083b888fd99f9edfc58b17b0702af8c7ce724
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mmf2d3d9.dll

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\mmf2d3d9.dll
        • Size 1.1MB
        • SHA256 fce87bf918787de7e8be0419941033dd98285eba51c79cfe16295f06e7b7cbc8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mmfs2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\mmfs2.dll
        • Size 459KB
        • SHA256 1cb098cfa35e4692cc2759a1b23100a1f6ccdc6da4dc2bd5abb586e207eeb0e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mp3flt.sft

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\mp3flt.sft
        • Size 24KB
        • SHA256 cd5bd7cc59eaf42bc0edf418ce6f077f9db369d5e3c414107b82492a877a6176
        • MD5 SHA1 SHA512 SSDEEP TLSH

        oggflt.sft

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\oggflt.sft
        • Size 130KB
        • SHA256 848d266c7676a5f59e66386d76679b97d2934166a8d829d5d000b217ab7a34cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pcxflt.ift

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\pcxflt.ift
        • Size 24KB
        • SHA256 81ce5610214cc648f6e968af8f31c1bce0430e4e9dc4427bba743bc6aadcba4e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pngflt.ift

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\pngflt.ift
        • Size 80KB
        • SHA256 7bdae43096b32eb072731a93e6423a848459f385a2f5859629af40e389273f7d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tgaflt.ift

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\tgaflt.ift
        • Size 24KB
        • SHA256 bbfd34aa3f6a66e59f06e30103c6248eee54896364ee0c714819b9286b985880
        • MD5 SHA1 SHA512 SSDEEP TLSH

        waveflt.sft

        • Path C:\Users\Admin\AppData\Local\Temp\mrt4E7F.tmp\waveflt.sft
        • Size 8KB
        • SHA256 41136b09b033a20b9acc430620ea095ff76afbdc7aebe7f26f7d2b4315afddef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2624-67-0x0000000002C00000-0x0000000002C17000-memory.dmp

        memory/2624-76-0x0000000002C30000-0x0000000002C44000-memory.dmp

        memory/2624-89-0x0000000002C70000-0x0000000002C94000-memory.dmp