0e7bbc68bc4d2a70af4743e5480f13d61bfdff0486a8647c587df31e750ff240

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
todosetup.exe
Size 2.2MB
Sample260730-apseeawanf
SHA256 0e7bbc68bc4d2a70af4743e5480f13d61bfdff0486a8647c587df31e750ff240
MD5 ad0fde6b9c178af7a515c450d5ffc3f8
SHA1 b973e5d337929e564d01377639b8d38be6de5018
SHA512 133a2689c3a94e8c43f72cf0379da77cfa7819402451ff45a0f9799e0a125e3c57d62b3fa9108565a887a872550183e24b348f138c6e15062b540466f12adc9a
SSDEEP 24576:CjGBlZOnYl03uJd1ZY4dOrTqwX/Wq/7C6c92EbBSAKMlE4A+W7du/XB5/1idT3UX:fJdgGwOq/26bE7KMG40gXNuTEzWH+F
TLSH
T1AEB5AE01BC818035C4F7D0301579F6B7D97D29341B6889DBB78C19BA6F709C1AA3EA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	1708	boot.exe

Executes dropped EXE 2 IoCs

pid	Process
1708	boot.exe
4320	todo.exe

Loads dropped DLL 5 IoCs

pid	Process
1708	boot.exe
4320	todo.exe
4320	todo.exe
4320	todo.exe
4320	todo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	todosetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	boot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	todo.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1708	1192	todosetup.exe	88
PID 1708 wrote to memory of 4320	1708	boot.exe	90

C:\Users\Admin\AppData\Local\Temp\todosetup.exe
"C:\Users\Admin\AppData\Local\Temp\todosetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1192
- C:\kasoft\y\boot.exe
  C:\kasoft\y\boot.exe
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\kasoft\y\todo.exe
    todo.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

todo[1].exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WV4CZIZ0\todo[1].exe
Size 3.2MB
SHA256 96f79e5616ec1f91dd8cdffebfedd4c987457fe60f123abf2d1b3f39e227554b
MD5 497f9c569d69a8915128b45695b9a57d
SHA1 5da952af77c86b7c68220db1bd334debe64ba767
SHA512 388ce288374064a12220936e828e09341a41ef16c904d5d0851b6b6bb916759b1b787bd3ae9bf6530541fbc10da47db9dc63cfa2d029073fe0f60ff70831caae
SSDEEP 49152:grZxCw+cmH6NC4BVo7FSs8ZwRuitDBlgr84Gvc7Camc4B:6xCw+cmHiC+VkSs8Kcit1lD4Wceamc4B
TLSH
T148E5E001FC838024C4F3C5314DA6B6A6D92A793C6F1509EB738D9EB877A16D09E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boot.exe

Path C:\kasoft\y\boot.exe
Size 1.2MB
SHA256 adcf51efe78ff1d0956d48cccb8a4b639328c9799ee95328ea59a79ffbd134b3
MD5 855d4b37bd484d91fe74b641f34ee900
SHA1 641a4798262ad33ea993ee5867fdf854e3341a8e
SHA512 4059fad0a5a3e480926df093f9b762073b6d0f62eaac779b9e8391df042b21fc750b88aa2a86b87ee51a2337fff778453644818ccd379544313e22130fc2d847
SSDEEP 24576:Dj5blZgnYqk3QrZ8ZY4dgrvawXWPcmeS6c9OtbQh:grZxCw+cm16DtS
TLSH
T1EC459D01BC82803DC8E2C17055AABAABE839193D07294CD7B3CC19F96BB4DD15E7E657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hspda.dll

Path C:\kasoft\y\hspda.dll
Size 270KB
SHA256 8367e887079553ec2591dd2fe27b7fa3defd09a2c84de6779b27513be1f91c37
MD5 ece17004d6e229372d2dd84f4e279dcf
SHA1 a8973d250c239ca4eb076359ea320134d18162d6
SHA512 8b8a28f57ede857f61c6214d8ea0017cc7d1ba85e5e3ec18357bf7c79b05e0e82d249e70398e8ba36f773cde8ba7ddd577c07d6bdab7d48d33fd12a4c0721cc6
SSDEEP 6144:hZSQt/7Ka3IOXOKl6I1xSnlE7BDykU5DDH7WpuPutfWc:/SQtjKYIOXOQ68SnlE7VykUhb7WpuPuJ
TLSH
T149446B11B8C0C072C5BB28345678D6B10EAD78310BB4DACF67D8193A9F751C1AB39B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hspext.dll

Path C:\kasoft\y\hspext.dll
Size 359KB
SHA256 98e1eeb7aec402a0f2ce44dc558f9d68e1aaaecf8a3c01e425d01d4e38a6c16d
MD5 0e95ff4e3a10ac700ee51902a4199f4c
SHA1 104c74d26428eb1ded8fa56628ac0e123e061bb7
SHA512 f3198636cd29741e45a5eb5ccbb29fe1cef1c931d1c3553ade7d16b745e1e6b4b07352d4440c1ff671a515543499a7e93c80aace4a27144027d3dbb2b8d582f1
SSDEEP 6144:i0j/uIz/k6ZF4zgE3ebPOMxReUJObMEeoVee9PjX6teeuiNjGcSm:7/r7e3ebPtxcuOb3zVSweuiNjT
TLSH
T1B3748E10FD818432C67B34744679E6B20DAC68302F799ADF975C097B9F744C1AA39A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hspinet.dll

Path C:\kasoft\y\hspinet.dll
Size 373KB
SHA256 fa0482e02f656cb35099cf8fe75c3e2cd4f275d23210e62a78be46d213db5847
MD5 7cd0da05d19a28546bfd8745dd6dfa01
SHA1 3ada668f85ac18f53d14f7b737a5422b26400fea
SHA512 10588ebae20a19fcb230b8f8226af350d7f26338b32a5b9bc49e173498f3c35ef9ab6ac8182a75f7fcae87a0c4e7afd215f722dae7b50e27784e778a8eecf496
SSDEEP 6144:VLK2UzXMaSsh8vXqWfhfqWtWjIQ191Ulv+L5FUEcWTMOyjAOCv9vUI7:VXUlSshkXqWUWUjIK91OwfcJTjOcI7
TLSH
T1BC84BF12B8D18531D4BF24381138EB7229AE65302B6DDCFBEB84172B5DA11D13636F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setting.ini

Path C:\kasoft\y\setting.ini
Size 49B
SHA256 82ab2b75f747b8cae1ac08d588d329ac7363d958aef8cc198861702db80f4693
MD5 43e85cb0c3c8e9acf50d250236111635
SHA1 6d3ab54ff88b9398eb9afc410d89dede6d3c45ae
SHA512 d118416f93f3f383e937bc784428de15fc4739cbfebc375c1c435e94bb8a1c92b2491ef2b7f688aa48a85762bce552f314f499d48aae413d9ea873993f2b18da
MD5 SHA1 SHA512

Submit Download

memory/4320-32-0x0000000002900000-0x0000000002949000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads