Analysis
- user interaction
yes - max time kernel
104s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 18:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
neverlose.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
neverlose.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target neverlose.rar
- Size 24.5MB
- Sample260723-xev4wavemh
- SHA256 fe681bb9009b306a3a73c3d8aa7edc1ed7ece504fd935fc7f587161aedc3f2cc
- MD5 8bd9623e88fb61d98f0c2634b2593691
- SHA1 9fac07b36e3ebf15a8676881769eeb9759537b97
- SHA512 a1ebbf8553cab28f150fabcd5dc6a2d6ea2bda66fed91553c2192b80700ed00ed68d1e2f0b7eda150a98c2b1d21a44af11407871abe121472866e7ab57c7116a
- SSDEEP 786432:5otwpq2KUFTjB17bXookaKj3LlBn5E5+k:5oWpSUJ3vXd9Kjnn+5p
- TLSH T1A547336BF7AFF4B661B0C531E05C8B3063A45B7C83441C39DAF909EA5653CBB5422A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5024 injector.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injector.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings injector.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe 5024 injector.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3856 7zFM.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3856 7zFM.exe Token: 35 3856 7zFM.exe Token: SeSecurityPrivilege 3856 7zFM.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3856 7zFM.exe 3856 7zFM.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4704 OpenWith.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\neverlose.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3856
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:6020
-
C:\Users\Admin\Desktop\neverlose\injector.exe"C:\Users\Admin\Desktop\neverlose\injector.exe" C:\Users\Admin\Desktop\neverlose\neverlose.dll1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5024
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4704
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Desktop\neverlose\injector.exe
- Size 10KB
- SHA256 f275c9fc108554794f176428983ad21fdd4bebcae6d294dbe80a4c053680dcfc
- MD5 31ae4c94456dfd036500dc465e46158b
- SHA1 69509a4c4a9b7a82518ce52ea1e5bbac7badbac4
- SHA512 7ebf7ef804e14a051e3da8598743f630490758613c618c68fc5692176ae85e9052b16d3fe88da193cad10ce30c69466fca8b4317a4e3cb20d2641063e7ef47a2
- SSDEEP 192:Sdak828jk4I6WMgJd9tw47Zq2bSibQm7E5pz6cS2a:SdF8jk4I6YJd9eSZJWibQm7N2
- TLSH T1E0222C83FFD05CF0EF6942380137D55EC7AE6A204A63BE176F94B8510976680F91A26F
- MD5 SHA1 SHA512 SSDEEP TLSH