6e95f6bec847284d367390181e64985d4fb9e1a4a6fcc078f367e9579e4177b6

Analysis

user interaction
yes
max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NetLimiter.Crack.exe
Size 475KB
Sample260722-vw2a4sdp2x
SHA256 6e95f6bec847284d367390181e64985d4fb9e1a4a6fcc078f367e9579e4177b6
MD5 588e0e5a3ffcdfceea39e43b064d420c
SHA1 104261cda9ed8b1d27c06f10f4cfc2ab112c0b1c
SHA512 edab1a77d34614772556adeb15e7c42a50f564cc0f96474628388c64b87b2603c3e7fd74c5afe75a9eb140b5bb4b1bc133aa6ad644191ab0a6668aa21ccba556
SSDEEP 12288:ruL2jlV8ANQ5hD+aAFKd93ekh45LIqKBV:+wg5lwkRdq8
TLSH
T123A42356739DAA62D6FF8DBCFB3080010AB13872F910D158BDCC844D9E6378186667BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1124	taskkill.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Colors	NetLimiter.Crack.exe

Modifies registry class 41 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	NetLimiter.Crack.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NetLimiter.Crack.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	NetLimiter.Crack.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	NetLimiter.Crack.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	NetLimiter.Crack.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	NetLimiter.Crack.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	NetLimiter.Crack.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	NetLimiter.Crack.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NetLimiter.Crack.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	NetLimiter.Crack.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	NetLimiter.Crack.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	NetLimiter.Crack.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NetLimiter.Crack.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	NetLimiter.Crack.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NetLimiter.Crack.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	NetLimiter.Crack.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NetLimiter.Crack.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	NetLimiter.Crack.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	NetLimiter.Crack.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\NotificationData	NetLimiter.Crack.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	NetLimiter.Crack.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NetLimiter.Crack.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	NetLimiter.Crack.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	NetLimiter.Crack.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NetLimiter.Crack.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	NetLimiter.Crack.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	NetLimiter.Crack.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NetLimiter.Crack.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	NetLimiter.Crack.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	NetLimiter.Crack.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	NetLimiter.Crack.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	NetLimiter.Crack.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	NetLimiter.Crack.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NetLimiter.Crack.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	NetLimiter.Crack.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NetLimiter.Crack.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	NetLimiter.Crack.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NetLimiter.Crack.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	NetLimiter.Crack.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	NetLimiter.Crack.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	NetLimiter.Crack.exe

Runs net.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4320	NetLimiter.Crack.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	taskkill.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4320	NetLimiter.Crack.exe
4320	NetLimiter.Crack.exe
4320	NetLimiter.Crack.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 1124	4320	NetLimiter.Crack.exe	90
PID 4320 wrote to memory of 4840	4320	NetLimiter.Crack.exe	92
PID 4840 wrote to memory of 1688	4840	net.exe	94

C:\Users\Admin\AppData\Local\Temp\NetLimiter.Crack.exe
"C:\Users\Admin\AppData\Local\Temp\NetLimiter.Crack.exe"
1⤵
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill" /f /im NLClientApp.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- C:\Windows\SYSTEM32\net.exe
  "net" stop nlsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop nlsvc
    3⤵
    PID:1688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4320-0-0x00007FFFABD1F000-0x00007FFFABD20000-memory.dmp

Download

memory/4320-1-0x0000021C39B40000-0x0000021C39BBA000-memory.dmp

Download

memory/4320-2-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-3-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-4-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-5-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-6-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-7-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-8-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-9-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-10-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-11-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-12-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-13-0x0000021C58130000-0x0000021C58256000-memory.dmp

Download

memory/4320-14-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-15-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-16-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-17-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-18-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-19-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

memory/4320-20-0x00007FFFABB90000-0x00007FFFAC534000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads