063b703bc745e06b4611fe4cac9ee2afa390f03fec9eb5105bbd32ca7f34786f

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
thedancer.exe
Size 345KB
Sample260807-ajtqaadj4w
SHA256 063b703bc745e06b4611fe4cac9ee2afa390f03fec9eb5105bbd32ca7f34786f
MD5 0d7762caa70984e39c8530bb4934deda
SHA1 d101e1485c03f5d72db95f48aff544d1816b99ad
SHA512 bdfd5a27e5231040d2df8cf413700a7c13ec63f5c15fb52293ed269fe32f04e1ff5f038d63d6a53a0c38e9c9224aaac53fc2d205184a8cd8f2ddb9daa1ebed27
SSDEEP 6144:dY71eudi4U9YHxmRws9/sEhZCw18PvP1M/CRANYmmBPTI3Hno51:iB1dhwvRL0S8PgbYmIPTUo51
TLSH
T1A074BF0DE7D2C5F1E8E6563450A36B7667386F0AC82BC7872754EE6A3C33211FA09359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	thedancer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5700	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5700	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\thedancer.exe
"C:\Users\Admin\AppData\Local\Temp\thedancer.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:240

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x0000000000000508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads