Analysis
- max time kernel
148s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 10:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe
- Size 1.6MB
- Sample260801-mxyydahn3t
- SHA256 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4
- MD5 eec9179c78fa73f3ab2140367e0612d2
- SHA1 f2dc4c5c02523cd4a5e7c3df85e9c5b5f18d792f
- SHA512 f41443b1012fe230eab348f50d3791049349a0af480c1ff7dadc393f803cecb5b68f5287696b00c8a89fe522b86613ca22a9485c59c02bd20b7e3e0e8f76b406
- SSDEEP 24576:7/tWL4KC4jJs4HYObDtv0zHNAgVWlLEPShqGXSvk/907XJCI5I28iAwd:7/gsKCkJl49VWlMSkAsTJAjBwd
- TLSH T1DE85E0127A81A032C67202328E6AF7A441BCBE75173195DFE3C81F2D1E75AC1AA35777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 58 IoCs
description ioc Process File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Portuguese\pr_1.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\ChineseTW\text.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\English\pr_2.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File opened for modification C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\Log\imyfone_down.log 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Korean\text.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Spanish\pr_2.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Japanese\pr_3.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\German\pr_2.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Chinese\pr_2.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\ChineseTW\pr_1.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\ChineseTW\pr_2.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Dutch\pr_1.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Dutch\text.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Japanese\pr_2.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Japanese\UrlInfo.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Portuguese\UrlInfo.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Dutch\pr_2.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\German\pr_1.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Korean\pr_1.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Spanish\pr_1.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\English\text.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Japanese\pr_1.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Italian\UrlInfo.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Chinese\pr_1.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Dutch\pr_3.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\English\pr_3.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\French\pr_1.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\French\pr_3.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\German\UrlInfo.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Italian\pr_3.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Portuguese\pr_2.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Spanish\text.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\productInfo.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Chinese\text.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Chinese\UrlInfo.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\ChineseTW\pr_3.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Korean\pr_3.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Spanish\pr_3.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Chinese\pr_3.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\English\pr_1.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Italian\text.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Portuguese\pr_3.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Portuguese\text.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Korean\pr_2.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Korean\UrlInfo.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Dutch\UrlInfo.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Italian\pr_1.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\German\pr_3.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\German\text.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Japanese\text.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Spanish\UrlInfo.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\language.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\ChineseTW\UrlInfo.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\English\UrlInfo.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\French\pr_2.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\Italian\pr_2.png 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\French\text.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe File created C:\Program Files (x86)\imyfone_down\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4\language\French\UrlInfo.ini 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4292 67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe"C:\Users\Admin\AppData\Local\Temp\67f20549ffae8ef2896f4095e8c69256e5be626f340daebae183d8fd932447e4.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4292