Overview
overview
6Static
static
3Client/Kni...ne.exe
windows10-2004-x64
6Client/Kni...ne.exe
windows11-ltsc_2024-x64
6Client/Snd...st.ps1
windows10-2004-x64
3Client/Snd...st.ps1
windows11-ltsc_2024-x64
3Client/Snd...32.dll
windows10-2004-x64
3Client/Snd...32.dll
windows11-ltsc_2024-x64
3Client/Snd...3d.dll
windows10-2004-x64
3Client/Snd...3d.dll
windows11-ltsc_2024-x64
3Client/Snd...3d.dll
windows10-2004-x64
3Client/Snd...3d.dll
windows11-ltsc_2024-x64
3Client/Snd...sp.dll
windows10-2004-x64
3Client/Snd...sp.dll
windows11-ltsc_2024-x64
3Client/Snd...x7.dll
windows10-2004-x64
3Client/Snd...x7.dll
windows11-ltsc_2024-x64
3Client/Snd...ax.dll
windows10-2004-x64
3Client/Snd...ax.dll
windows11-ltsc_2024-x64
3Client/Snd...p3.dll
windows10-2004-x64
3Client/Snd...p3.dll
windows11-ltsc_2024-x64
3Client/Snd...sx.dll
windows10-2004-x64
3Client/Snd...sx.dll
windows11-ltsc_2024-x64
3Client/Snd...ft.dll
windows10-2004-x64
3Client/Snd...ft.dll
windows11-ltsc_2024-x64
3Client/Snd...ce.dll
windows10-2004-x64
3Client/Snd...ce.dll
windows11-ltsc_2024-x64
3Client/mss32.dll
windows10-2004-x64
3Client/mss32.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
Client/KnightOnLine.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Client/KnightOnLine.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
Client/Snd/captain_abcast.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Client/Snd/captain_abcast.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
Client/Snd/redist/mss32.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Client/Snd/redist/mss32.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
Client/Snd/redist/mssa3d.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
Client/Snd/redist/mssa3d.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
Client/Snd/redist/mssds3d.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
Client/Snd/redist/mssds3d.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
Client/Snd/redist/mssdsp.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
Client/Snd/redist/mssdsp.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
Client/Snd/redist/mssdx7.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
Client/Snd/redist/mssdx7.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
Client/Snd/redist/msseax.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
Client/Snd/redist/msseax.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
Client/Snd/redist/mssmp3.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
Client/Snd/redist/mssmp3.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
Client/Snd/redist/mssrsx.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
Client/Snd/redist/mssrsx.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
Client/Snd/redist/msssoft.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
Client/Snd/redist/msssoft.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
Client/Snd/redist/mssvoice.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
Client/Snd/redist/mssvoice.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
Client/mss32.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
Client/mss32.dll
Resource
win11ltsc2024-20260709-en
General
- Target Client/Snd/redist/msseax.dll
- Size 113KB
- Sample260808-y8xp8sysdw
- SHA256 37faa064ea1e5ae4909ab97f96a43f1d8fc5e40380c0d30ee78e61560daed264
- MD5 b24028b6511fa3cb96bcbf1ef2838696
- SHA1 b007a44ab65b52581ad4b3764b04b01150e6d3ce
- SHA512 3771335f15a8ad862940342543fd1d912246fae8bf10cde0ca0174248a98175ec9fff6c7c7a3b60e6c7891287b7bf3485a32c7680d081544e8c2db198485ab48
- SSDEEP 1536:h9MwFTgw/AfFmQVLMY+aErTASmWf6B0lH200JgRU3RP2k9OOUvtmgMbFulZbcvSk:h9Mw1nMxmTxNf6MWsRU3RLQAg0Fu/c2
- TLSH T138B37E222F92C0F1DF6A1538245E3B7AA9368E18023B51FBDFB2DF5A5924710793F518
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 720 wrote to memory of 2548 720 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Client\Snd\redist\msseax.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Client\Snd\redist\msseax.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2548
-