Overview
overview
6Static
static
3Client/Kni...ne.exe
windows10-2004-x64
6Client/Kni...ne.exe
windows11-ltsc_2024-x64
6Client/Snd...st.ps1
windows10-2004-x64
3Client/Snd...st.ps1
windows11-ltsc_2024-x64
3Client/Snd...32.dll
windows10-2004-x64
3Client/Snd...32.dll
windows11-ltsc_2024-x64
3Client/Snd...3d.dll
windows10-2004-x64
3Client/Snd...3d.dll
windows11-ltsc_2024-x64
3Client/Snd...3d.dll
windows10-2004-x64
3Client/Snd...3d.dll
windows11-ltsc_2024-x64
3Client/Snd...sp.dll
windows10-2004-x64
3Client/Snd...sp.dll
windows11-ltsc_2024-x64
3Client/Snd...x7.dll
windows10-2004-x64
3Client/Snd...x7.dll
windows11-ltsc_2024-x64
3Client/Snd...ax.dll
windows10-2004-x64
3Client/Snd...ax.dll
windows11-ltsc_2024-x64
3Client/Snd...p3.dll
windows10-2004-x64
3Client/Snd...p3.dll
windows11-ltsc_2024-x64
3Client/Snd...sx.dll
windows10-2004-x64
3Client/Snd...sx.dll
windows11-ltsc_2024-x64
3Client/Snd...ft.dll
windows10-2004-x64
3Client/Snd...ft.dll
windows11-ltsc_2024-x64
3Client/Snd...ce.dll
windows10-2004-x64
3Client/Snd...ce.dll
windows11-ltsc_2024-x64
3Client/mss32.dll
windows10-2004-x64
3Client/mss32.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
169s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
Client/KnightOnLine.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Client/KnightOnLine.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
Client/Snd/captain_abcast.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Client/Snd/captain_abcast.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
Client/Snd/redist/mss32.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Client/Snd/redist/mss32.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
Client/Snd/redist/mssa3d.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
Client/Snd/redist/mssa3d.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
Client/Snd/redist/mssds3d.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
Client/Snd/redist/mssds3d.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
Client/Snd/redist/mssdsp.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
Client/Snd/redist/mssdsp.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
Client/Snd/redist/mssdx7.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
Client/Snd/redist/mssdx7.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
Client/Snd/redist/msseax.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
Client/Snd/redist/msseax.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
Client/Snd/redist/mssmp3.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
Client/Snd/redist/mssmp3.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
Client/Snd/redist/mssrsx.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
Client/Snd/redist/mssrsx.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
Client/Snd/redist/msssoft.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
Client/Snd/redist/msssoft.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
Client/Snd/redist/mssvoice.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
Client/Snd/redist/mssvoice.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
Client/mss32.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
Client/mss32.dll
Resource
win11ltsc2024-20260709-en
General
- Target Client/Snd/redist/mssrsx.dll
- Size 361KB
- Sample260808-y8xp8sysdw
- SHA256 43da4d7c40db81a7bc19214d4bddf38910fe5ded8722a6b0bcf53280b1f43d8c
- MD5 75600ef1750ae9a49540c1f6c9a89e29
- SHA1 9b5ae0a8fdcdb463e936867a775a312a2954ef15
- SHA512 cf58176faa0429a40dc641609eeb297665752c226cf7d1dd58120365964727ba827be9771698e2137df555c99c6ea72b3d4a190ac0082afe383aec20f309a6b1
- SSDEEP 6144:nWc4QZeiYnRXSGR3PUoAYyYLgS/z9JjXX1v0Apc/FB2AOq/yGbK:n/HeznMo3oYzX1vBpcL2g5K
- TLSH T13C74D043F1D340F4CC0235765C1A3337AA327B098D2AD9636B64DFB56D236A5A63E31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4296 wrote to memory of 3532 4296 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Client\Snd\redist\mssrsx.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Client\Snd\redist\mssrsx.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3532
-