Overview
overview
6Static
static
3Client/Kni...ne.exe
windows10-2004-x64
6Client/Kni...ne.exe
windows11-ltsc_2024-x64
6Client/Snd...st.ps1
windows10-2004-x64
3Client/Snd...st.ps1
windows11-ltsc_2024-x64
3Client/Snd...32.dll
windows10-2004-x64
3Client/Snd...32.dll
windows11-ltsc_2024-x64
3Client/Snd...3d.dll
windows10-2004-x64
3Client/Snd...3d.dll
windows11-ltsc_2024-x64
3Client/Snd...3d.dll
windows10-2004-x64
3Client/Snd...3d.dll
windows11-ltsc_2024-x64
3Client/Snd...sp.dll
windows10-2004-x64
3Client/Snd...sp.dll
windows11-ltsc_2024-x64
3Client/Snd...x7.dll
windows10-2004-x64
3Client/Snd...x7.dll
windows11-ltsc_2024-x64
3Client/Snd...ax.dll
windows10-2004-x64
3Client/Snd...ax.dll
windows11-ltsc_2024-x64
3Client/Snd...p3.dll
windows10-2004-x64
3Client/Snd...p3.dll
windows11-ltsc_2024-x64
3Client/Snd...sx.dll
windows10-2004-x64
3Client/Snd...sx.dll
windows11-ltsc_2024-x64
3Client/Snd...ft.dll
windows10-2004-x64
3Client/Snd...ft.dll
windows11-ltsc_2024-x64
3Client/Snd...ce.dll
windows10-2004-x64
3Client/Snd...ce.dll
windows11-ltsc_2024-x64
3Client/mss32.dll
windows10-2004-x64
3Client/mss32.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
184s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
Client/KnightOnLine.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Client/KnightOnLine.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
Client/Snd/captain_abcast.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Client/Snd/captain_abcast.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
Client/Snd/redist/mss32.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Client/Snd/redist/mss32.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
Client/Snd/redist/mssa3d.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
Client/Snd/redist/mssa3d.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
Client/Snd/redist/mssds3d.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
Client/Snd/redist/mssds3d.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
Client/Snd/redist/mssdsp.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
Client/Snd/redist/mssdsp.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
Client/Snd/redist/mssdx7.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
Client/Snd/redist/mssdx7.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
Client/Snd/redist/msseax.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
Client/Snd/redist/msseax.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
Client/Snd/redist/mssmp3.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
Client/Snd/redist/mssmp3.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
Client/Snd/redist/mssrsx.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
Client/Snd/redist/mssrsx.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
Client/Snd/redist/msssoft.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
Client/Snd/redist/msssoft.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
Client/Snd/redist/mssvoice.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
Client/Snd/redist/mssvoice.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
Client/mss32.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
Client/mss32.dll
Resource
win11ltsc2024-20260709-en
General
- Target Client/Snd/redist/mssds3d.dll
- Size 79KB
- Sample260808-y8xp8sysdw
- SHA256 3443fc45bafc64331dff5c212bfe8e67c1b1d6ed5b7d547e2dbff7aeab8987d4
- MD5 3756b51b8ba9672e9a623287bbe36aec
- SHA1 7630f22a282845c16894b3454471d727b0b573eb
- SHA512 9ad6b69c39a05f3abe51dabdb5cd6f3f0d76cb8e2e3d936ad3c600a44ce0d275853043bd990eec383e4dc71fa9daf887d37680543538e5438587367efb74961d
- SSDEEP 1536:N95InR3bDYt9lBIG2If25vtmgMbFuG8qcv:j5c3bs9efAg0Fugc
- TLSH T108837D373FE3C0F2EDBA1174045E3B3BA536580941B985BB8FF4DB8A4D66680953A253
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2688 wrote to memory of 3960 2688 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Client\Snd\redist\mssds3d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Client\Snd\redist\mssds3d.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3960
-