Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
General
- Target 51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe
- Size 6.2MB
- Sample260722-xt9ktabb22
- SHA256 51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949
- MD5 97bbbce9ba7177bd7a12cd02e4031b75
- SHA1 ae1a2b8ec46012b25137111d543b035387bb6342
- SHA512 5ca4c5fae56c5fbbe3ceecf98a46dbc389c8e18315b4108e47a7ab705976e5e559d6e4407b11c0373406d941de4d61243eedf6dc377af5a8f298dc1845024969
- SSDEEP 49152:l8sNG/eeEiCHvnD7REY6h7a0Yy7n3XEh70vbIyPT8JRoKFTMSt+rzRFUObO3iBCs:TLEBTnPQ4Uj+PRFsiYSn7rzd1I
- TLSH T1C166E13BB56501ECD0A7C0B895ABA517EA303C4903705ADB03D55A1A2FB7AD01E7FA27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 4948 51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe 4948 51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe 4948 51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4948 51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4948 51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4948 51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4948 51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe 4948 51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe 4948 51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe 4948 51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe 4948 51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe 4948 51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe"C:\Users\Admin\AppData\Local\Temp\51adb769df3ac347efabde44580456ddb28276571c2046a7feed976616f7e949.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4948
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\GameClicker\custom.ini
- Size 102B
- SHA256 231dc719785e516554091e7ad55fdec6f46abce7900f75143cc394e4d4747949
- MD5 a8486494967aade7e7a54e0fb9f9ab02
- SHA1 9f1ff846ffd3fd39e8c32825ca820a8a9d87fea6
- SHA512 bc67348c6f19f14f3d98a683232ddab9cd1f3074501f10cd619572aa742d49ee1ec13a6a1e88ff19e04fcee9506bb36c160efb972a645ae806c8a9bb012856a6
- TLSH T1B3B0129E113C934BD9021383845C4A00E4F32B2295415F87054DD0E4EF53206043A02C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\GameClicker\settings.ini
- Size 3KB
- SHA256 cf4c1bff5f2a77f7e7c1e50d5e2e22a0b6d55add7af790896553c05746854d94
- MD5 4cc8ba734ef3399a1f29b764d20699d7
- SHA1 e4f571581fedc4c8f87c6a32ca17cf70216d7f3b
- SHA512 4a54d7e672a86293fa90c9b291a5a69ddea2d6ca12dbea851efc8b3a08d616f96b9f5d79bb5462f6887d038138a23375f98b2deb462ce971618d9c327f90836f
- TLSH T14561CAE235084FAF74B7796260341494B9A168B6F832D438AAB3D031FB1CF5247D964F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\evbB8D7.tmp
- Size 1KB
- SHA256 ec871cd4e87f2946f78b8e8c8ab611fcd9c68b2ed9082fb8a520c316ef33ebc2
- MD5 9ead1c1d1d7149bcfe4e92cb9e2be081
- SHA1 efbfa8d841361d4c75e2020f01886ac700d3cb36
- SHA512 785b40bd0b0521c2e20327a2b3801ecec292d146f5724d2f5361538ce63c5b1f0f9b7e4cdd0bbe76961dfaa83dfbbf1e3d0e559edd2b1a5afa6bef8a7b7dfd57
- TLSH T16F315E12D610CAB7C14D077896D2992C26B8AC3453E916560FB0047DFC853704A39D09
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\evbB927.tmp
- Size 1KB
- SHA256 8575da28a70b2977a3b2b9052240085acf5fb50f772c3fd6e8cd63e9286f10dd
- MD5 e58dd744b8d9d0a6a0ac255b27f36bbf
- SHA1 371a5d27270094628522bf2187312ceb33dc6c35
- SHA512 5bcd8ec74c2a8151051695b59d21e818678b60e43a0c7a41682bbb2f74ee09e49ec82ad8337a6ba164d41a5354d61c795977cf1468084c87e2df2ab93130b19d
- TLSH T1F9315E12DA108AB2C14D073896D2992C26B8AC3453E917560FB0047DECD53304E3AD09
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\evbB966.tmp
- Size 1KB
- SHA256 c23dece820c9bb66eddaef8a7284884d71a7acfcebd00b8d09a7181104797d6b
- MD5 2efec71e8101611981363c55dc2a3c51
- SHA1 5d152b0b04725c5c5e4bfa1bedc69d888f5a73ea
- SHA512 6377baf1dd23a844db9b5a42d48bc6854c6786cb264c147d4afacd47f382e9ff424adb55bf5a3042d5bc678c722a1a1b1feb77aab315a732eb1f81406a7f5450
- TLSH T1D131A713D610CAB3C14D073897E2952C66B86C3453FA16560FF0047DFC953704A39D09
- MD5 SHA1 SHA512 TLSH