e48496439a1735812e02a7fd6a6e6a7d9a7a7e0547f31a7f1284770cc50c1a6d

Analysis

max time kernel
58s
max time network
58s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IK_Multimedia_Keygen.exe
Size 411KB
Sample260808-smlsyseb26
SHA256 e48496439a1735812e02a7fd6a6e6a7d9a7a7e0547f31a7f1284770cc50c1a6d
MD5 cfc47c0f143d0bcdd0fe2257264321d4
SHA1 6aea55b6b38fc63c96b32e5500e91359863ba887
SHA512 ffd6af66438b370d99f413be34bd453c7c67a5b58e93374f7ceeee19a8347e9ce279370d83ff1c0023ded8933665c5d7e1c32f8040b62156f163da3495d6fa49
SSDEEP 6144:a+MvoJH2nA8P9tlASRzKW3FuVhl6wd7vHnaRm3kr3qWfjOpf/DIqwI0+3CWamyt:a+tc9t2Sll1ohlpJvaUUbx6FcOCms
TLSH
T1BB940216BE54C5A3E8734375887B5A6239FB7E26C776124F67C4772839B3342800BA87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1364	keygen.exe

Loads dropped DLL 3 IoCs

pid	Process
1364	keygen.exe
1364	keygen.exe
1364	keygen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IK_Multimedia_Keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4052	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4052	AUDIODG.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 1364	3360	IK_Multimedia_Keygen.exe	88

C:\Users\Admin\AppData\Local\Temp\IK_Multimedia_Keygen.exe
"C:\Users\Admin\AppData\Local\Temp\IK_Multimedia_Keygen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1364

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x0000000000000508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BASSMOD.dll

Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.dll
Size 33KB
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
TLSH
T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R2RIKM3.dll

Path C:\Users\Admin\AppData\Local\Temp\R2RIKM3.dll
Size 6KB
SHA256 f0f1bfd3c048f1565fd8c76a47c6436935ee5193448d042575b9a56bbe2f1cc1
MD5 1fc74abff10c6f084f64ab48146081a9
SHA1 39cefce27bb5d498ba01a7398a0e12bb4b93cc78
SHA512 505f4c75174fe06aa1b652afade01c388449466ccfe591cd865c9731381f080ca3f98be73ca6050efc8aa201b5965b45ec42edaf0f0e5d3f7105dbf3a88f8ecb
SSDEEP 96:twl2T3JwFj4WZ24CV3Xjrnq42JclnlpLxc:twl2ThMKVHvq42ilp
TLSH
T1E9C1B7B7D3A4CD61E3AC02F83597A62E7EDE62700B7057793B404D1E0AD0A66FD06253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bgm.xm

Path C:\Users\Admin\AppData\Local\Temp\bgm.xm
Size 53KB
SHA256 498eadc5b3d65aaf34b8496954c3362f033297c489d7ef4559cba8890c530171
MD5 a30878984af33ee69ace5cf8e330b974
SHA1 916e9098ad80f3e79502adac42820b1ffbae1eb6
SHA512 f3ddaf6d3b4e12928efe5c167e8d010c858f19d4bf5a9698b4aabe21e53b5762ad667c81bd4e119083b6213bc96869056538dfc6fcdfc8147cfb1f1ea0c2162f
SSDEEP 1536:DGdQy+5/LlKjQy+5/LlK8g0tg09wVi91yOU:idQy+5/LlKQy+5/Ll/g0tg09wgzn
TLSH
T191333152667954A8F15337340C2D0B2673B3BB267A0E31E77B5DAD00AF59F89D88834B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
Size 455KB
SHA256 2c089231a13c856acc8d64ce827b2d7eead74dd1ff7f582f1ca1951d53a9a974
MD5 14fe1ae2e0a7e584c18fba3d913aae21
SHA1 c0000e824cf091d971837b6a569c9e18d8ca2930
SHA512 bb1864a91f9934837a4ff4654257042978e475af5959c0be9fc137c3782c0d3ddeacbbf055d2817186f3faf6d6c385b009429547ac06a36fec049885b3dbb567
SSDEEP 6144:icmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAOXEyI9Kndp05JjocAw:ic/kEPDonR6Y436vRuyI9Kj03jotw
TLSH
T118A49042E222F4FFF9F9033D92463515C0102A5C87A6E9EFA7D7095A9C343D316A26DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1364-7-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1364-12-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1364-16-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1364-17-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1364-18-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1364-19-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1364-20-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1364-21-0x0000000010000000-0x0000000010013000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads