Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 12:26
Behavioral task
behavioral1
Sample
MP-Hacks ESP v5.0/MP-Hacks ESP.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
MP-Hacks ESP v5.0/MP-Hacks ESP.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
MP-Hacks ESP v5.0/MP-Hacks ESP.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
MP-Hacks ESP v5.0/MP-Hacks ESP.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
ReadMe.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
ReadMe.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target MP-Hacks ESP v5.0/MP-Hacks ESP.exe
- Size 22KB
- Sample260721-pmbffabn21
- SHA256 0434fe06678f0b8d2a54786f1274c56d8a4212f3169676eba5421e3957d36ee7
- MD5 2226a3cdca1c6d4895a3e5d2bb1c7f3b
- SHA1 da81b280c81dd3aa628200912ad2d837b2a0875c
- SHA512 7dc7655d741d24d4ecf57457b30df8f67c8f55ce3fabe5a86e3ba672725a81bfac2e52c5cd3a28418afde02a171d8d986bc38ce5d78096058070505e3421b8a7
- SSDEEP 384:/04ntqTypPQ+y9gXwLAJiP/Ug5F4NSXGDb513P4Bs6iOHJq8uOL:xtyyW+y92wHP/Ug8S2BhOP
- TLSH T1BDA2D0366BC1C39ADF687973C124621870897E02DDF96DD715DA328BBDCC2E0179C929
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral4/memory/2128-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral4/memory/2128-1-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral4/memory/2128-2-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral4/memory/2128-3-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral4/memory/2128-6-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral4/memory/2128-8-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral4/memory/2128-9-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral4/memory/2128-13-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral4/memory/2128-15-0x0000000000400000-0x0000000000410000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MP-Hacks ESP.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe 2128 MP-Hacks ESP.exe