Analysis
- max time kernel
175s - max time network
175s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 16:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Brokkr-windows-arm64.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
5 signatures
900 seconds
Behavioral task
behavioral2
Sample
Brokkr-windows-arm64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral3
Sample
Brokkr-windows-arm64.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral4
Sample
Brokkr-windows-arm64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
900 seconds
General
- Target Brokkr-windows-arm64.exe
- Size 28.0MB
- Sample260801-txpg9sde47
- SHA256 04f2d2126977c7d1a95bec4987c9f76a0e9cfc1958ce1e4882a867219c2e40ea
- MD5 0042382a1b1739a5a2e8210a1f6e7988
- SHA1 c613bb49024cc382315f18342951d59a5ab8e9c3
- SHA512 de428b08b30c4599a587c662b50db39d8af0bc51a338083e51b4e84e14e97b32b06c8cde51ceb79b118c9a7eef53d275dc6aaee3565f1f9a3ecf41357d14a90e
- SSDEEP 786432:ossi1f1B7CuZbU0Km5KBDgy5tVdZRV6n+kpw:o1i1fXNbULmovTVHP6ve
- TLSH T15E5733BBB3DA8C0FF69523B109A40353F17606808E49D1FBAA7C365BB4578D86D0A35D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 1936 Brokkr-windows-arm64.exe 1936 Brokkr-windows-arm64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 55 IoCs
description ioc Process File created C:\Program Files\Brokkr\translations\qt_ru.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_uk.qm Brokkr-windows-arm64.exe File opened for modification C:\Program Files\Brokkr\redist\ Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\bin\Qt6Svg.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\plugins\imageformats\qgif.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_de.qm Brokkr-windows-arm64.exe File opened for modification C:\Program Files\Brokkr\redist\vc_redist.arm64.exe Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\bin\Qt6Core.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\bin\dxcompiler.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\bin\dxil.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_bg.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_fa.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_ko.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_lv.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_nl.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\plugins\imageformats\qjpeg.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\plugins\imageformats\qsvg.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\plugins\styles\qmodernwindowsstyle.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\plugins\tls\qschannelbackend.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_it.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_pt_BR.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_tr.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\bin\qt.conf Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\plugins\imageformats\qico.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_en.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_fr.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_hu.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_lg.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_sk.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_zh_CN.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_gd.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_nn.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_pl.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_zh_TW.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\Uninstall.exe Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_da.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\bin\Qt6Gui.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\plugins\generic\qtuiotouchplugin.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\plugins\networkinformation\qnetworklistmanager.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\plugins\platforms\qwindows.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_es.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_he.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_cs.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\bin\Qt6Widgets.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\plugins\tls\qcertonlybackend.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_ar.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_ca.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_fi.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_hr.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_ka.qm Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\bin\Qt6Network.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\bin\brokkr.exe Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\plugins\iconengines\qsvgicon.dll Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\redist\vc_redist.arm64.exe Brokkr-windows-arm64.exe File created C:\Program Files\Brokkr\translations\qt_ja.qm Brokkr-windows-arm64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Brokkr-windows-arm64.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsa4533.tmp\UserInfo.dll
- Size 4KB
- SHA256 a921cc9cc4af332be96186d60d2539cb413dfa44cfd73e85687f9338505ff85e
- MD5 f8b6dd1f9620be4ef2ad1e81fb6b79fa
- SHA1 f06c8c8650335bace41c8dbe73307cbe4e61b3b1
- SHA512 f15811088ecde4cd0c038db2c278b7214e41728e382b25c65c2eb491bc0379c075841398e8c99e8cceba8be7e8342bc69d35836ebe9b12ebebff48d01d5fa61a
- TLSH T1A78173BB92E40CF3D0A44BB740A71CE362B5DD301762001F4A478AAA2590B67EE7E715
- MD5 SHA1 SHA512 TLSH