Overview
overview
7Static
static
522ca053ce2...53.exe
windows10-2004-x64
722ca053ce2...53.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3phototool.exe
windows10-2004-x64
5phototool.exe
windows11-ltsc_2024-x64
5General
- Target 22ca053ce238019bedddbc3706b2ccb2a214d7b943d97b372e8dd226c9c49b53
- Size 1.5MB
- Sample260801-ntbt4stfph
- SHA256 22ca053ce238019bedddbc3706b2ccb2a214d7b943d97b372e8dd226c9c49b53
- MD5 29ad78a29d69a4bf5f65dc718f6c9970
- SHA1 8e69dcfe63e57386e6d2ea503e9448f5919f4aa1
- SHA512 2467ab2613c90fc17c3cdbb7951ba47c54bd6e30b227133b160a34c737f541eb7fa732cb659a5aa68fb92653a2eb713cee24671f19012695741b8e9e2f6c1d91
- SSDEEP 49152:oLWYFh8zepWnftTeheOgmE2FqhEwaAeEyLsXNiTBJ9l:oiYFQSWnftTWeZiFiEAaxJX
- TLSH T15B7512216798985DDC2B76BB48A794BC31627D4CD470063B31C2BA6DB3BB31610DBA4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
22ca053ce238019bedddbc3706b2ccb2a214d7b943d97b372e8dd226c9c49b53.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
22ca053ce238019bedddbc3706b2ccb2a214d7b943d97b372e8dd226c9c49b53.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
phototool.exe
Resource
win10v2004-20260513-en
Malware Config
Targets
-
- Target 22ca053ce238019bedddbc3706b2ccb2a214d7b943d97b372e8dd226c9c49b53
- Size 1.5MB
- SHA256 22ca053ce238019bedddbc3706b2ccb2a214d7b943d97b372e8dd226c9c49b53
- MD5 29ad78a29d69a4bf5f65dc718f6c9970
- SHA1 8e69dcfe63e57386e6d2ea503e9448f5919f4aa1
- SHA512 2467ab2613c90fc17c3cdbb7951ba47c54bd6e30b227133b160a34c737f541eb7fa732cb659a5aa68fb92653a2eb713cee24671f19012695741b8e9e2f6c1d91
- SSDEEP 49152:oLWYFh8zepWnftTeheOgmE2FqhEwaAeEyLsXNiTBJ9l:oiYFQSWnftTWeZiFiEAaxJX
- TLSH T15B7512216798985DDC2B76BB48A794BC31627D4CD470063B31C2BA6DB3BB31610DBA4B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 760df89c2341f9c39c0250c283cb9caad185244fd6b76e8157cdf49928dc1d8e
- MD5 5e2fd68a1ce97cc2866becb699fdb4c0
- SHA1 55469bdaea8e9660f69f15107affda81de2787ae
- SHA512 de94531b4f0d85bfb8de5a30390631dca84064e48f1984b7521d54382ddd26e3d886738455a4ed7fcba3f7ee8b092cf01cadcb8c3326b9fa5721e6d952db871e
- SSDEEP 48:S46+/DTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mW2ofjLl:zpuPbO5tCZBVEAWyMEFv2CmuL
- TLSH T14BC19370B3D248B9D591413778AB33D36612EE746784504FDB6315AA3820AE7AD3EBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target phototool.exe
- Size 1.3MB
- SHA256 0a393b84a6d9c4bb98ddbaef87e4fc77f34cfa49801655f523d970a33d568a62
- MD5 65382b069a79a181c58c4e87faf6e3fd
- SHA1 ad581dfde8c61c317d0fddd9d5981b0e1a7fc980
- SHA512 57669e7f5cc9afc324af8773ee1bb44b0c883fbd782def057ad692faeec031f7b33a04d7ada7ad1b1f90a53ad4ac82cca6a577bc0d05cbbd4a0f37aeac36338d
- SSDEEP 24576:7hZDqH2zDRR0I6TkhbFJocswXAu37+PByzzKeOvnmBqXoVrR+tD:S4wI6TkhbFJzswXLuGfO/ql+p
- TLSH T134553372CB74D390C5BEB6F19093ADA42C0C632244C75F9F4F684B85983E2794E7692A
- MD5 SHA1 SHA512 SSDEEP TLSH