0e7bbc68bc4d2a70af4743e5480f13d61bfdff0486a8647c587df31e750ff240

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
todosetup.exe
Size 2.2MB
Sample260730-apcc7aam4s
SHA256 0e7bbc68bc4d2a70af4743e5480f13d61bfdff0486a8647c587df31e750ff240
MD5 ad0fde6b9c178af7a515c450d5ffc3f8
SHA1 b973e5d337929e564d01377639b8d38be6de5018
SHA512 133a2689c3a94e8c43f72cf0379da77cfa7819402451ff45a0f9799e0a125e3c57d62b3fa9108565a887a872550183e24b348f138c6e15062b540466f12adc9a
SSDEEP 24576:CjGBlZOnYl03uJd1ZY4dOrTqwX/Wq/7C6c92EbBSAKMlE4A+W7du/XB5/1idT3UX:fJdgGwOq/26bE7KMG40gXNuTEzWH+F
TLSH
T1AEB5AE01BC818035C4F7D0301579F6B7D97D29341B6889DBB78C19BA6F709C1AA3EA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2416	boot.exe

Loads dropped DLL 1 IoCs

pid	Process
2416	boot.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	boot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	todosetup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6004 wrote to memory of 2416	6004	todosetup.exe	89

C:\Users\Admin\AppData\Local\Temp\todosetup.exe
"C:\Users\Admin\AppData\Local\Temp\todosetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6004
- C:\kasoft\y\boot.exe
  C:\kasoft\y\boot.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

boot.exe

Path C:\kasoft\y\boot.exe
Size 1.2MB
SHA256 adcf51efe78ff1d0956d48cccb8a4b639328c9799ee95328ea59a79ffbd134b3
MD5 855d4b37bd484d91fe74b641f34ee900
SHA1 641a4798262ad33ea993ee5867fdf854e3341a8e
SHA512 4059fad0a5a3e480926df093f9b762073b6d0f62eaac779b9e8391df042b21fc750b88aa2a86b87ee51a2337fff778453644818ccd379544313e22130fc2d847
SSDEEP 24576:Dj5blZgnYqk3QrZ8ZY4dgrvawXWPcmeS6c9OtbQh:grZxCw+cm16DtS
TLSH
T1EC459D01BC82803DC8E2C17055AABAABE839193D07294CD7B3CC19F96BB4DD15E7E657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hspinet.dll

Path C:\kasoft\y\hspinet.dll
Size 373KB
SHA256 fa0482e02f656cb35099cf8fe75c3e2cd4f275d23210e62a78be46d213db5847
MD5 7cd0da05d19a28546bfd8745dd6dfa01
SHA1 3ada668f85ac18f53d14f7b737a5422b26400fea
SHA512 10588ebae20a19fcb230b8f8226af350d7f26338b32a5b9bc49e173498f3c35ef9ab6ac8182a75f7fcae87a0c4e7afd215f722dae7b50e27784e778a8eecf496
SSDEEP 6144:VLK2UzXMaSsh8vXqWfhfqWtWjIQ191Ulv+L5FUEcWTMOyjAOCv9vUI7:VXUlSshkXqWUWUjIK91OwfcJTjOcI7
TLSH
T1BC84BF12B8D18531D4BF24381138EB7229AE65302B6DDCFBEB84172B5DA11D13636F6B
MD5 SHA1 SHA512 SSDEEP TLSH