Overview
overview
3Static
static
3مافيا...ng.exe
windows10-2004-x64
3مافيا...ng.exe
windows11-ltsc_2024-x64
3مافيا...I2.dll
windows10-2004-x64
1مافيا...I2.dll
windows11-ltsc_2024-x64
1مافيا...te.dll
windows10-2004-x64
3مافيا...te.dll
windows11-ltsc_2024-x64
3مافيا...64.dll
windows10-2004-x64
1مافيا...64.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
148s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 16:19
Static task
static1
Behavioral task
behavioral1
Sample
مافيا svt/سيرفر سوفيت svt/Creative EAX Setting.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
مافيا svt/سيرفر سوفيت svt/Creative EAX Setting.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
مافيا svt/سيرفر سوفيت svt/Guna.UI2.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
مافيا svt/سيرفر سوفيت svt/Guna.UI2.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral5
Sample
مافيا svt/سيرفر سوفيت svt/VoicemeeterRemote.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
مافيا svt/سيرفر سوفيت svt/VoicemeeterRemote.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral7
Sample
مافيا svt/سيرفر سوفيت svt/VoicemeeterRemote64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
مافيا svt/سيرفر سوفيت svt/VoicemeeterRemote64.dll
Resource
win11ltsc2024-20260709-en
General
- Target مافيا svt/سيرفر سوفيت svt/Creative EAX Setting.exe
- Size 1.6MB
- Sample260802-tsjffscm8w
- SHA256 de5673f509f9f6cc151543b9c308251c41f51c4fe39b04e9109494522d5d9a64
- MD5 6ae20e7f8be8e07accf4cd0e6889325f
- SHA1 1ba72328d14a60168eba9936ca45d4556bc95939
- SHA512 2415c457eae9202245da255547cf71f50c6390a38f49bbe076c0f52c87fbd7fa4f0d39121fb91e6d3c9fd34623c84590a7dfc9b3e0d431513b31a7a8ae880cf1
- SSDEEP 49152:0uxgaMj3XRD+uj3H2Cuk1+Lda3Wvho0o5KDe+WgnyOijCij:00DMj3XZ+ujX2Cuk1+Lda3WvhowDeSyD
- TLSH T120754AD2E94489D5F92D06B2A4269D7012A32D7EEDF4A49D68CABC2765B3343103FC1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Creative EAX Setting.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Creative EAX Setting.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Creative EAX Setting.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion Creative EAX Setting.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\مافيا svt\سيرفر سوفيت svt\Creative EAX Setting.exe"C:\Users\Admin\AppData\Local\Temp\مافيا svt\سيرفر سوفيت svt\Creative EAX Setting.exe"1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:5708
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3380