Analysis
- user interaction
yes - max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 16:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
getreign.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
getreign.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target getreign.exe
- Size 1.0MB
- Sample260808-tfyplsec66
- SHA256 071fe6496d8d39ff58dfd866e07769ff30e56455cfc050d7645823bcb36cfbc1
- MD5 6cdb0e08a26db02987c389f24928c003
- SHA1 791af674bb0b01a4920c1438675334a8d090cd78
- SHA512 7b0901fb2dbf29d7658b06b9f8c12e235c47d8df6707f3fadbac824b377bdefddd5bba84932fc07d8fab970ce5a1b539e6c55acb592b77e88664ce5fe61f462a
- SSDEEP 24576:j3uKfXTq0CcleTUjBmu3F3o2/zyb9mtE+km:j9fm4Z/Gb9Q/
- TLSH T1CF257C5A7BA840B9E067D17AC9578646F7F274460730A6CF03A047BE2F673A15F3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 3948 getreign.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe 3948 getreign.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\getreign\openvr_api.dll
- Size 819KB
- SHA256 54ad7fe4cdb4d88fa818dbf8eb3d1f8ca2ae3b34d2ff115f87191d7d88e0a009
- MD5 7cf409ea8a7a772bb33caed38de74c37
- SHA1 84122a5b88cd3661ce80faa26771343b15c7822b
- SHA512 f1f0fafff62f64101001bac3a657387ba9b2d94981319d105c288b4ab8a72f5a77b4ab47ceb3dbf77b97965caa6230f776d7691eb2b184f2723932bbaa6cabe1
- SSDEEP 12288:usAAjBUvNuMOrFOeoNMi4VSUvKbDhClFos67VbCfcrzUlk7:uUjBmu3F3o2/zyb9mtE+k7
- TLSH T11C058D5A7BA840B9E467E17AC5538646F7F2B4561B30978F13A0037E6F673A14E3E320
- MD5 SHA1 SHA512 SSDEEP TLSH