Overview
overview
3Static
static
3d3d9.dll
windows10-2004-x64
3d3d9.dll
windows11-ltsc_2024-x64
3uMod.exe
windows10-2004-x64
3uMod.exe
windows11-ltsc_2024-x64
3uMod_d3d9_DI.dll
windows10-2004-x64
3uMod_d3d9_DI.dll
windows11-ltsc_2024-x64
3uMod_d3d9_HI.dll
windows10-2004-x64
3uMod_d3d9_HI.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/07/2026, 18:06
Static task
static1
Behavioral task
behavioral1
Sample
d3d9.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
d3d9.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
uMod.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
uMod.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
uMod_d3d9_DI.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
uMod_d3d9_DI.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral7
Sample
uMod_d3d9_HI.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
uMod_d3d9_HI.dll
Resource
win11ltsc2024-20260709-en
General
- Target uMod.exe
- Size 3.1MB
- Sample260723-wpyr3stgrd
- SHA256 8b68d6269469d8735c405de12c9552c20ff3e934b70120d8f1c6256d6965d58f
- MD5 720e85c3032e6ccab7e0128857f25d39
- SHA1 c034bf16f0010f9decbbc0038751682cd329c2ca
- SHA512 317b830ee3d579b1950230271c7cb40c5bb30513de9ee7ee363d4ddd034b1b15aed57f7379c8d93de045ee6e508f8f92aec4325c719700ef96adaa8993a2677f
- SSDEEP 49152:hW4OUaIgWI2dwgwc2sbv5SQam5cUhUsjcTigtzwNTjb4:hW4Obkd+c2sboeHgtzw
- TLSH T133E57C01FBDB80B6D9B756B415E1A32E052ABDA527384AD7D3501F9F69323C29D3230E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uMod.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2748 uMod.exe 2748 uMod.exe 2748 uMod.exe 2748 uMod.exe