Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 10:41
General
- Target Glary Utilities v6.x Keymaker.exe
- Size 1.9MB
- Sample260802-mreyba1cmc
- SHA256 255f9db5ebf56204803df5774435111c8a9127d24220853e4a7aaab4e2965eba
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Control Panel 1 IoCs
- Modifies registry class 28 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Glary Utilities v6.x Keymaker.exe"C:\Users\Admin\AppData\Local\Temp\Glary Utilities v6.x Keymaker.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x000000000000049C 0x00000000000004941⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4220-0-0x0000000000400000-0x000000000091F000-memory.dmp
memory/4220-1-0x0000000002760000-0x00000000027C0000-memory.dmp
memory/4220-3-0x0000000000F40000-0x0000000000F41000-memory.dmp
memory/4220-9-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4220-8-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/4220-7-0x0000000002720000-0x0000000002721000-memory.dmp
memory/4220-6-0x00000000028D0000-0x00000000028D1000-memory.dmp
memory/4220-5-0x0000000000F30000-0x0000000000F31000-memory.dmp
memory/4220-4-0x0000000002750000-0x0000000002751000-memory.dmp
memory/4220-2-0x0000000002700000-0x0000000002701000-memory.dmp
memory/4220-41-0x0000000003830000-0x0000000003831000-memory.dmp
memory/4220-43-0x0000000003830000-0x0000000003831000-memory.dmp
memory/4220-42-0x0000000002920000-0x0000000002921000-memory.dmp
memory/4220-22-0x0000000003830000-0x0000000003831000-memory.dmp
memory/4220-46-0x0000000000F20000-0x0000000000F21000-memory.dmp
memory/4220-45-0x0000000000BB0000-0x0000000000BB1000-memory.dmp
memory/4220-44-0x0000000003830000-0x0000000003832000-memory.dmp
memory/4220-21-0x0000000003830000-0x0000000003831000-memory.dmp
memory/4220-20-0x0000000003830000-0x0000000003831000-memory.dmp
memory/4220-19-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4220-18-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4220-17-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4220-16-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4220-15-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4220-14-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4220-13-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4220-12-0x0000000002740000-0x0000000002741000-memory.dmp
memory/4220-11-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4220-10-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4220-40-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4220-39-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4220-38-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4220-37-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4220-36-0x0000000002A10000-0x0000000002A11000-memory.dmp
memory/4220-35-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4220-34-0x00000000029F0000-0x00000000029F1000-memory.dmp
memory/4220-33-0x00000000029B0000-0x00000000029B1000-memory.dmp
memory/4220-32-0x0000000002A20000-0x0000000002A21000-memory.dmp
memory/4220-31-0x00000000029C0000-0x00000000029C1000-memory.dmp
memory/4220-30-0x00000000029D0000-0x00000000029D1000-memory.dmp
memory/4220-29-0x0000000003830000-0x0000000003831000-memory.dmp
memory/4220-28-0x0000000002980000-0x0000000002981000-memory.dmp
memory/4220-27-0x00000000028F0000-0x00000000028F1000-memory.dmp
memory/4220-26-0x0000000002930000-0x0000000002931000-memory.dmp
memory/4220-25-0x0000000002970000-0x0000000002971000-memory.dmp
memory/4220-24-0x0000000002900000-0x0000000002901000-memory.dmp
memory/4220-23-0x0000000002910000-0x0000000002911000-memory.dmp
memory/4220-47-0x0000000000400000-0x000000000091F000-memory.dmp
memory/4220-48-0x0000000002760000-0x00000000027C0000-memory.dmp
memory/4220-49-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4220-50-0x0000000003830000-0x0000000003831000-memory.dmp
memory/4220-51-0x0000000000400000-0x000000000091F000-memory.dmp
memory/4220-52-0x0000000000400000-0x000000000091F000-memory.dmp
memory/4220-53-0x0000000000400000-0x000000000091F000-memory.dmp
memory/4220-54-0x0000000000400000-0x000000000091F000-memory.dmp
memory/4220-55-0x0000000000400000-0x000000000091F000-memory.dmp
memory/4220-56-0x0000000000400000-0x000000000091F000-memory.dmp
memory/4220-58-0x0000000000400000-0x000000000091F000-memory.dmp
memory/4220-59-0x0000000000400000-0x000000000091F000-memory.dmp
memory/4220-60-0x0000000000400000-0x000000000091F000-memory.dmp
memory/4220-61-0x0000000000400000-0x000000000091F000-memory.dmp
memory/4220-62-0x0000000000400000-0x000000000091F000-memory.dmp
memory/4220-63-0x0000000000400000-0x000000000091F000-memory.dmp
memory/4220-64-0x0000000000400000-0x000000000091F000-memory.dmp
memory/4220-65-0x0000000000400000-0x000000000091F000-memory.dmp