Overview
overview
6Static
static
3Client/Kni...ne.exe
windows10-2004-x64
6Client/Kni...ne.exe
windows11-ltsc_2024-x64
6Client/Snd...st.ps1
windows10-2004-x64
3Client/Snd...st.ps1
windows11-ltsc_2024-x64
3Client/Snd...32.dll
windows10-2004-x64
3Client/Snd...32.dll
windows11-ltsc_2024-x64
3Client/Snd...3d.dll
windows10-2004-x64
3Client/Snd...3d.dll
windows11-ltsc_2024-x64
3Client/Snd...3d.dll
windows10-2004-x64
3Client/Snd...3d.dll
windows11-ltsc_2024-x64
3Client/Snd...sp.dll
windows10-2004-x64
3Client/Snd...sp.dll
windows11-ltsc_2024-x64
3Client/Snd...x7.dll
windows10-2004-x64
3Client/Snd...x7.dll
windows11-ltsc_2024-x64
3Client/Snd...ax.dll
windows10-2004-x64
3Client/Snd...ax.dll
windows11-ltsc_2024-x64
3Client/Snd...p3.dll
windows10-2004-x64
3Client/Snd...p3.dll
windows11-ltsc_2024-x64
3Client/Snd...sx.dll
windows10-2004-x64
3Client/Snd...sx.dll
windows11-ltsc_2024-x64
3Client/Snd...ft.dll
windows10-2004-x64
3Client/Snd...ft.dll
windows11-ltsc_2024-x64
3Client/Snd...ce.dll
windows10-2004-x64
3Client/Snd...ce.dll
windows11-ltsc_2024-x64
3Client/mss32.dll
windows10-2004-x64
3Client/mss32.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
Client/KnightOnLine.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Client/KnightOnLine.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
Client/Snd/captain_abcast.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Client/Snd/captain_abcast.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
Client/Snd/redist/mss32.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Client/Snd/redist/mss32.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
Client/Snd/redist/mssa3d.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
Client/Snd/redist/mssa3d.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
Client/Snd/redist/mssds3d.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
Client/Snd/redist/mssds3d.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
Client/Snd/redist/mssdsp.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
Client/Snd/redist/mssdsp.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
Client/Snd/redist/mssdx7.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
Client/Snd/redist/mssdx7.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
Client/Snd/redist/msseax.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
Client/Snd/redist/msseax.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
Client/Snd/redist/mssmp3.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
Client/Snd/redist/mssmp3.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
Client/Snd/redist/mssrsx.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
Client/Snd/redist/mssrsx.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
Client/Snd/redist/msssoft.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
Client/Snd/redist/msssoft.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
Client/Snd/redist/mssvoice.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
Client/Snd/redist/mssvoice.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
Client/mss32.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
Client/mss32.dll
Resource
win11ltsc2024-20260709-en
General
- Target Client/Snd/redist/mssa3d.dll
- Size 96KB
- Sample260808-y8xp8sysdw
- SHA256 6b5d0e461f119a9e95e10de24aada3306407acf1c2e1841b26c4c1a5f950224c
- MD5 5dfda618d9dc11ac3a36264100b40e74
- SHA1 f1161745b3460c7faa321c52805b0df541c8f553
- SHA512 bc3657fcd76206defcda297a3fff5ec14dd1dd86f3181f83c20800ad4e431249aad3f74012918915007c36fcdd5da0dee3025776d26a344fa1ab344d8e1ca419
- SSDEEP 1536:Y5nj8G4DXVZJOOsz9AJ1+2U5G92/vtmgMbFuYRZDHcvlJf:w8G4DF7OOQgSAg0FuWHcNJ
- TLSH T1E5A36C2137D3C1F5DD6F0574142D2BBEAA3A190540798CBB9FE2EEAD4F15E40A13E292
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4336 wrote to memory of 2484 4336 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Client\Snd\redist\mssa3d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Client\Snd\redist\mssa3d.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2484
-