Overview
overview
6Static
static
3Client/Kni...ne.exe
windows10-2004-x64
6Client/Kni...ne.exe
windows11-ltsc_2024-x64
6Client/Snd...st.ps1
windows10-2004-x64
3Client/Snd...st.ps1
windows11-ltsc_2024-x64
3Client/Snd...32.dll
windows10-2004-x64
3Client/Snd...32.dll
windows11-ltsc_2024-x64
3Client/Snd...3d.dll
windows10-2004-x64
3Client/Snd...3d.dll
windows11-ltsc_2024-x64
3Client/Snd...3d.dll
windows10-2004-x64
3Client/Snd...3d.dll
windows11-ltsc_2024-x64
3Client/Snd...sp.dll
windows10-2004-x64
3Client/Snd...sp.dll
windows11-ltsc_2024-x64
3Client/Snd...x7.dll
windows10-2004-x64
3Client/Snd...x7.dll
windows11-ltsc_2024-x64
3Client/Snd...ax.dll
windows10-2004-x64
3Client/Snd...ax.dll
windows11-ltsc_2024-x64
3Client/Snd...p3.dll
windows10-2004-x64
3Client/Snd...p3.dll
windows11-ltsc_2024-x64
3Client/Snd...sx.dll
windows10-2004-x64
3Client/Snd...sx.dll
windows11-ltsc_2024-x64
3Client/Snd...ft.dll
windows10-2004-x64
3Client/Snd...ft.dll
windows11-ltsc_2024-x64
3Client/Snd...ce.dll
windows10-2004-x64
3Client/Snd...ce.dll
windows11-ltsc_2024-x64
3Client/mss32.dll
windows10-2004-x64
3Client/mss32.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
168s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
Client/KnightOnLine.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Client/KnightOnLine.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
Client/Snd/captain_abcast.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Client/Snd/captain_abcast.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
Client/Snd/redist/mss32.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Client/Snd/redist/mss32.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
Client/Snd/redist/mssa3d.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
Client/Snd/redist/mssa3d.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
Client/Snd/redist/mssds3d.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
Client/Snd/redist/mssds3d.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
Client/Snd/redist/mssdsp.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
Client/Snd/redist/mssdsp.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
Client/Snd/redist/mssdx7.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
Client/Snd/redist/mssdx7.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
Client/Snd/redist/msseax.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
Client/Snd/redist/msseax.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
Client/Snd/redist/mssmp3.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
Client/Snd/redist/mssmp3.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
Client/Snd/redist/mssrsx.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
Client/Snd/redist/mssrsx.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
Client/Snd/redist/msssoft.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
Client/Snd/redist/msssoft.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
Client/Snd/redist/mssvoice.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
Client/Snd/redist/mssvoice.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
Client/mss32.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
Client/mss32.dll
Resource
win11ltsc2024-20260709-en
General
- Target Client/Snd/redist/msssoft.dll
- Size 76KB
- Sample260808-y8xp8sysdw
- SHA256 62233bebccb6aeb97370a8499c577e2982f46924e3a1bc55c53fa1f8a2404252
- MD5 3e9029826d8cb962874584ab795a9d31
- SHA1 93c97838aa3dccf8ad33341f94d9d1303166cee7
- SHA512 949ce71af730262719ba6c442df07e3074ee512a2c55560ce5d09de9d5de179c08fba485317a508ea887b7ecc9278b1b1fd4a1cf728cfb7a2ff3f602660406c2
- SSDEEP 1536:Ks4jt/rC6vB3ZNdYZeBX+bzzc2EmGaKvtmgMbFuNQcvg7:GpC6vjNdKKObHUAg0FuWc
- TLSH T147739FF276E3C3B6CCBA017224997BBA61356506007CC57B4FF0D5DB9E60B50A86B392
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4668 wrote to memory of 1040 4668 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Client\Snd\redist\msssoft.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Client\Snd\redist\msssoft.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1040
-