5c4f368d0515078ce5e6f78df59740591554fb7cbca6f298399ef0b4c28d9a05

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 05:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Valhalla.DSP.Valhalla.VintageVerb.v1.7.1.(Mac-Win) Incl.Patched.and.Keygen-R2R/R2R/ValhallaDSP_KeyGen.exe
Size 536KB
Sample260801-fy9b6sec63
SHA256 5c4f368d0515078ce5e6f78df59740591554fb7cbca6f298399ef0b4c28d9a05
MD5 7f1b439e8f0f57c995a3244dbd67a86b
SHA1 43f57b1bf43ceaf709235cd86eae0361d05acafd
SHA512 fe929109cf2f89e89722793bb5c678bc14b88dc1f7b6939553311e13df67c5f0a0f62a2c71737e3ae58db7fe65cfcfc29baa63eb170cbf4320223f3f139716f9
SSDEEP 12288:sc9t2SllUjJUgMZwixstqkYoH9huVF8eXdBJ+DB:scLyNhwsLbWVF8eX8V
TLSH
T114C41252AA688EE7C6BB477015FBDE213AFA3D1195A6194B73947B34F633202700B5C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2744	keygen.exe

Loads dropped DLL 3 IoCs

pid	Process
2744	keygen.exe
2744	keygen.exe
2744	keygen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ValhallaDSP_KeyGen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3208	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3208	AUDIODG.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2744	2560	ValhallaDSP_KeyGen.exe	89

C:\Users\Admin\AppData\Local\Temp\Valhalla.DSP.Valhalla.VintageVerb.v1.7.1.(Mac-Win) Incl.Patched.and.Keygen-R2R\R2R\ValhallaDSP_KeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\Valhalla.DSP.Valhalla.VintageVerb.v1.7.1.(Mac-Win) Incl.Patched.and.Keygen-R2R\R2R\ValhallaDSP_KeyGen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2744

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BASSMOD.DLL

Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL
Size 33KB
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
TLSH
T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R2RJUCE.dll

Path C:\Users\Admin\AppData\Local\Temp\R2RJUCE.dll
Size 294KB
SHA256 b4a6cab1de8cdc2b704f0bcc34d51644d82ecda4aa346dba232cd7623786f3a9
MD5 66d3dc009d5cfeb5157ddc08dc5443d0
SHA1 b8416a1bcac62ab882900e8298dc8e66dfdb8e96
SHA512 cdbf1f11f491a91e53e46243256bfc8b07450102fc41b0114ae8a65c08b23f6d0782f11393a6b69ff4906e565707bdc30cce15b5e7a39cfb8e12258ae1ee8811
SSDEEP 6144:y2y9fytBg/nDX1fjOkOM005kBFmKeAOzGTBFUROpE9o:wViBg/nDXhq/05kBMH1GTHxpE9o
TLSH
T174549F01F493C073C27E15305EB9BA551ABE78700AB499BF7BD84E1E4E741D0B722AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bgm.mod

Path C:\Users\Admin\AppData\Local\Temp\bgm.mod
Size 52KB
SHA256 014ff2aea33267ae4bb89274b5b6dc48bf22caf051dcc882c339a8c0da705e23
MD5 d6beadc81bc8481c95996e6333735bbe
SHA1 cae63073b1a77fdd6f101d4b44a3d0c8578829b2
SHA512 139a9ece9a2f7b1ac2fa530be205f545a60c67df1343cba1024ad7b1eb27c39ae84287598be43ba1414eace77814a1359f01361940b5650fcab4e2bd280a4d19
SSDEEP 768:FJ2IWfkpGAgaxsaXAny2ESpZ5JCmBPw/VWgyUZ3DveY9:FWfkpGsx9CdCmH+37l9
TLSH
T1A13337DE9F177B1AC4896A705C5F4AA53F854063EA9205BEF058BF20F7BE3700E54224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
Size 661KB
SHA256 2b6c17e56e38a32a8d15f65cfbfd8784cdf0f992724ed0d5214a7482d466db04
MD5 0c2b114132ffe0a6d244c492fcc31b0c
SHA1 2a2ae26101c343f6bb0b2a235ed1a0165a580fb4
SHA512 857602851f7675a3b63b46d72e9d7e53725b035ad057773506af8abf976c7d8249eac6268ef32b9b6356b09a209f430f385c2c4fbbd2e9d9b835e11c122000af
SSDEEP 6144:tPA4GcGvY6Q4rOQonRBVSszRNAOWLxnMMY6xY15XGB+K:tpGVQ4KQonRBVrzRNj725
TLSH
T1F4E4E77501B3AFA4EA37B37B7B9901C49E8429F7FE1ACC561938E0D8380DC9356A6153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2744-21-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2744-24-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2744-17-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2744-18-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2744-19-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2744-20-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2744-10-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2744-22-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2744-23-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2744-14-0x0000000000B00000-0x0000000000B4E000-memory.dmp

Download

memory/2744-25-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2744-26-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2744-27-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2744-28-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2744-29-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2744-30-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2744-31-0x0000000010000000-0x0000000010013000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads