c5fe14d0ed94002312b948bd9427f1b3ed87b226426c8ffc9311cc5a729f419a

Analysis

max time kernel
154s
max time network
171s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 15:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deltamod-204-windows-x64-installer.exe
Size 363.1MB
Sample260814-s49aksaf39
SHA256 c5fe14d0ed94002312b948bd9427f1b3ed87b226426c8ffc9311cc5a729f419a
MD5 694bbcd5bb000fd9c49b471e0e2ba2bd
SHA1 43d705b53a8ae58c0b32c17098fce75833e2bbe9
SHA512 20a10dba161cebddd05ab6f6201128740b19533d5a732fb53bd66e0296eb4f08a209da544fe4125482d7d42ea403fc8a8131604532727c7f335f43db95ecda66
SSDEEP 6291456:t/hyeRylDZOSKuRYP8LTfCtP66aRRQq/m4+RPBni5z+K:t/HRylDZNKqYPUTKs6aWB4+RPBnid+K
TLSH
T1BA093303C36110DCD59A83389E8B9662E632BC291534BBDA5564F7341FB3E10BFE961E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion trojan

Malware Config

Signatures

Loads dropped DLL 15 IoCs

pid	Process
3212	deltamod-204-windows-x64-installer.exe
3212	deltamod-204-windows-x64-installer.exe
3212	deltamod-204-windows-x64-installer.exe
3212	deltamod-204-windows-x64-installer.exe
3212	deltamod-204-windows-x64-installer.exe
3212	deltamod-204-windows-x64-installer.exe
3212	deltamod-204-windows-x64-installer.exe
3212	deltamod-204-windows-x64-installer.exe
3212	deltamod-204-windows-x64-installer.exe
3212	deltamod-204-windows-x64-installer.exe
3212	deltamod-204-windows-x64-installer.exe
3212	deltamod-204-windows-x64-installer.exe
3212	deltamod-204-windows-x64-installer.exe
3212	deltamod-204-windows-x64-installer.exe
3212	deltamod-204-windows-x64-installer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	deltamod-204-windows-x64-installer.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	deltamod-204-windows-x64-installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	deltamod-204-windows-x64-installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	deltamod-204-windows-x64-installer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3212	deltamod-204-windows-x64-installer.exe
3212	deltamod-204-windows-x64-installer.exe

C:\Users\Admin\AppData\Local\Temp\deltamod-204-windows-x64-installer.exe
"C:\Users\Admin\AppData\Local\Temp\deltamod-204-windows-x64-installer.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BR32E.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000c8c\BR32E.tmp
Size 300KB
SHA256 79db5bad60f95217c585ea5e7258ebfbfc226c7dc0048b99eec6f37e97f3eb9b
MD5 2c44dfb17f877ac5ec95139bcd497944
SHA1 c3f1f6167df50cabe38ae37356f0852db34d0452
SHA512 5504a9926b69334443a59b96ba34a80999acdcf0053aee46cc8682d715b9fbad6facd0c3dbcc30b898dec71f28d755bab8c530dea4ad97d8f8a57db9a6ccf663
SSDEEP 3072:Uu6fDZodXT9khGza7dy/vBRXOyhiqLB6APA11sehbEeQN0zWsQVkHA0kQlaTj:4bET9kg/RXOyhi8Qm9QlaTj
TLSH
T16F643A96F785DEABC60502304DFA47597738F1D4174F9B172A2CA2342E63BE0BE93A05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR39C.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000c8c\BR39C.tmp
Size 356KB
SHA256 3524ec77985e390acf9d07d81b1b44305165d711bbca770f7458ea0a78751f82
MD5 c3c4f3fe90e3b3b02bea0e8da3447ed2
SHA1 7ac0f54119d2273a2cd261f1fe6c5667e9c486df
SHA512 0e24c9394c635a3f1671a297f97b613e6936cd8f862a214125d3456324a18668ae138d5c4fde036f55e2b13b158e4cebc53f78153862a008b1ae747eab228a60
SSDEEP 6144:VaGsA5DNPvUvxrBSTj80COxO7PnDrK9RmvHCV7/Zv1fuvIl2:9sA5DlvUvNBSTjwOn9Avi71WvIE
TLSH
T1EA742933EFA215E9D87FC07889A3A313EEF1758C0429B68B4654CF055F66B51B239B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR41A.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000c8c\BR41A.tmp
Size 59KB
SHA256 be88244da9faaa6636a9d2f4c4249c08066a0b48359690b9b27a2b9ed47e093d
MD5 f62dd6ce51e19349ec1d1f2e88c4ef4d
SHA1 60bd29538b4fecaf527ba8b7d92b7f32d2e72ddb
SHA512 ba68a59427ec252b895e1c3d6879e0c7a010893d23b5a8687ce86d738faaec1367f73abbcf63fb8ce8b95d32afa3049cd59f22f0bc5a2ff2a3b123a54fe02012
SSDEEP 768:kpR8lUiZHswDCxdJvuD0WZVVVR8RiTg8U2GO6WtxHDVBNqxsC4:uilUiihx3vVWGgTgT2GVWtC+D
TLSH
T1EC43D69679D49CDADA38823C45E7D2337638F9E006134B1B6634AA360F23FD17ED9681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR45A.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000c8c\BR45A.tmp
Size 127KB
SHA256 aa1517dae8670a4f30543c78b5ed5d3a3d2e8e5d25a5785f2a51f96afb0521cc
MD5 1e8473635fe00150f1ce488b63999397
SHA1 f5cffd86d3cd249d6d369ecd617db180126379ef
SHA512 118a8e94c6a926317f9a7c88d18ea8b8bd8ab3b1c45f00fbcd3775534bf651b2e7e2986d206362e2fb716eb26f1eb220bcd1c004d5264f2e019f38a5d53447f1
SSDEEP 3072:Rm9fOd2UU62aaUzhTnTQx4+kP2IwpHh88zeWhxJbx1ZZpuTtdhG6q71mcQC+:Yfs8iLuI4O0hxJbx1n4TtDRGQr
TLSH
T1DFD33B13F2A250DCC6BF8178456B9673F571F0261238BF6F2A24D6352FA1E51332EA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR47A.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000c8c\BR47A.tmp
Size 819KB
SHA256 2b14ba9c3d7ec52dfa2ff3b506c856bad6205d90484ad6bb1856b3bc89a40920
MD5 d9ccf8c595ce798ef6146451a30f81d0
SHA1 e0b72320ef44d0019c66f304dc77db130e900430
SHA512 837e8c214b4f4f7f64bb61c03fe28b61190ffec3b9dc8c5c8ab218fee367cd0815546c0988efc2c74af63281fa3468fc5e47145fb054b3caf559d3fc1fb23379
SSDEEP 24576:Ily2aQFM3uh+ryZwFpoLqZzg8P/9UQRZWztD:gyVQFM3uMryZQSFIO3z
TLSH
T142054B13E68370FDC897C3345697D722E632B4181E327AAB3292EA35FE52E711397611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR517.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000c8c\BR517.tmp
Size 235KB
SHA256 aaa3d7e589e9be1911eee5974afa68c64af1bbd5e039ff6a82a15c2b54c0f9f0
MD5 51c675fc1ef0a62322052d3e86567c06
SHA1 e295d0b668105d81f9180ef1056d0528e4b2116a
SHA512 a352e82db5c930c73165a48337ae51acda7ebd393b8b0b57d03d2e1b5057c41c26b1f321759b7bc521166890853ecdad7b37531212243ad86e181e2252a3b78d
SSDEEP 1536:fvHdOlJYzc4WrA5jDuSILZnyjGi98RkYD1a9okwGN0DCcFAyG6MifymQxz+ZIKx3:ATc5WrA5jiAjXKR3HdCcqyG6e/NC5
TLSH
T192342CC875D4A8D3E67F837566C2F92272BCF2909723DF0392908E35052ABC56F66D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR537.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000c8c\BR537.tmp
Size 24KB
SHA256 2b93420dc2b1b8a74bf3d75fe99232303a3f692ceb1fdf2df27d40b7e8e6fa53
MD5 485ee2bcd31212c6088086081e7427ae
SHA1 749f4ed6ce7b5b26ac1f2d947afba7acdb19aaf9
SHA512 74b42018747b15420fa31004f07c7cffbda9517799864fdc4990a25595a942bf21f40e3b181fe182aaae4625049b665c80bbaebae0e63c0a1113a6a24c7c0741
SSDEEP 384:EwdQDOvZjrRVQ5UIyxqJbbSdn8X8SrTBBdofPviG2GLGnT:7Qcv5IBqn9Sryd
TLSH
T100B2E82FB7536CADC426C3BC52F68673E9F1781626329A2D4210D6703F72CA05BBE954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR623.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000c8c\BR623.tmp
Size 19KB
SHA256 034756f772399552cd33605a189ee0e45d7947860e0d83ec12aa6da1a5a42054
MD5 a56543b9cd3aa403311b49189d25851e
SHA1 bd2609d35d4a967fe23ef4092b1daa6f74a858ad
SHA512 2237f493d70799675ae0e395f551b6cd46ff4789e46e2453c48fede07b7623b4b8111904d6fa139c204eea4405b5fd5812b0a91f27374219b721339149c25edf
SSDEEP 384:szVLiyxZuZ1R0PCtHIsyhxCTPBX0O1Ok:ELiyx60Y2XC5L1
TLSH
T10E92F90FBBC294ADC53BD37482F7D732987174611236762A0764DB705FA0EA0AB7D628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR79B.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000c8c\BR79B.tmp
Size 36KB
SHA256 22d4a48d7dd5c51c63e277944a91511e69d514721b5cd60b7da877d38bd8744d
MD5 a8b2a9bc29f24b733d35a8ef30551edd
SHA1 3faee2d4e1ce3ddcaa4c560c40e045cf147622cc
SHA512 aca6c103b737e0142913fd12b6783464c7edba1953a0bd07084e996a070a7118d1f571249882f982dc7bd47656ac23b86b598b434176b3ab9553b63512771d78
SSDEEP 768:8r25kBCvId7ntYYOc0niTIwgbfyNdVVVVVRIFRkTbSs0:A2dvUO3nKWqy4HSs
TLSH
T100F23A2BF65398DCD767C274C9A36B33E871BC2011216D3E5F28D7306EA1DA28B4E645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR7AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000c8c\BR7AB.tmp
Size 96KB
SHA256 9426e96a97f41645fab524385a852687792f99b505554b6b9809ed99451b2399
MD5 9b299884420745d80c70bba6b8a7f05a
SHA1 195423185a7776e072a65fbabae868c15f7b2f56
SHA512 ed839dc1b6ef53f3663b6055fb2869a522600b2af8d8a800958ddb531154f4e9a3f1733f32dff5511a22fe01525191c8683519cbdcedec138b1bcf3425f2155b
SSDEEP 1536:EbWmOP8RKRZ6j2oGbgY2pUA6hHkVWWdXW:rf8XyoxpUA+HYdXW
TLSH
T13BA319817B945CD9C9759A3C46F6D3326A3DF5E002B39F4B9B2496380F12AD1FF88648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR7CC.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000c8c\BR7CC.tmp
Size 569KB
SHA256 02501524d73a3f62ac87f90f12cb6dde7100ca4a4352f3cdee66986276ed9b30
MD5 6aae21a55035693f523327108991899f
SHA1 6625fcca180e624d3e49476d5783451f08410029
SHA512 b2aba1a1a70a5d066d7bb6ba76f5b2dfec2ffa09ab97d668bf409b0c253605d90c722dc0a5804c8cedb7dae83d00b1e9054ddf84c527366f2885ceb19e5e392f
SSDEEP 6144:Td+7ylaLETa/6EJuMlZNYUWBwnBPpAqTvsKqd5TKXTjW61RIlR:Td+Ola/6EoMl8UWWPpAqTvQ6fn1RIlR
TLSH
T15EC45D57FBC19DABC50943314CAB03997735F19413DFAB5B2A2CA2382E53BD4BE86604
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR859.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000c8c\BR859.tmp
Size 26KB
SHA256 44e5f5f11a3c25be0880819cb42647fb7840d6b3260ef32c91a8ae44d308e58f
MD5 56ec6f11e89a3b8c34d7465a7a887a68
SHA1 8aa6f5a584a5fbc195d9ec2fe9aaf05203615b9c
SHA512 81362d299a5259db9dbd12d654ce2372ca2eac36bdfec29071f2ded353cbe6ca41dee801d3fdaf0ef0232027ca2042179faeb6c92da1fc896f47e7e026c1a227
SSDEEP 384:Gpdh0MtlEe5dufwwHezmAWZtxbS4vVuBpoOdWoTMB8JFtOezSpQ9t:gRtl/LwH2FW7SnJWoppOY
TLSH
T1D7C2FA1AE36315EDC527C57582BAE333E8B17C161134B32A9A60EF351F31BD0A71A729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR86A.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000c8c\BR86A.tmp
Size 40KB
SHA256 c9deef1cc37b85c2c166fbcbee6f018a2d65128abb170174e80c129f3171b065
MD5 8374ba3961c06702059039498055bd6b
SHA1 ffa611afc2487744f2bff64f16ad4bc9c50a5c40
SHA512 9082448a999951a2fa2d27762641237f8dcbf59fef8edf7459eebfd30147617192bfb8ab0d6080c611560703b99ff0825166ceb763b2b0811bbbb813969b6493
SSDEEP 384:Lxv9Ls6tWNkrErbyRibbk7S8sirUEKlvYr5vbZGTYBFSX/zTzfTUrHczc:du6tWir1sJINtGTHzfTov
TLSH
T1AE132A5AB983C8ADC513C1B082B6BB33E5B174110125ED3E2721DF745FB7F906A2BA19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR87A.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000c8c\BR87A.tmp
Size 209KB
SHA256 3257c2d167916a57e61022fff9a9bd9ea0a7c9f1ce8f00eea4c84039f4519200
MD5 92214d8b40f8a391e3ce67ceb9780e39
SHA1 81cb719a5a72420f611082dd93eebc39921892d1
SHA512 3295ea719445377c9ff7a009dc6bf077d180dd8803ee2a94cb44c45f98b8045505734f74aba34239013f84f06c15a095aabec019d1fde1addeb47d6972e5b7e4
SSDEEP 3072:hLNfuqA0ZtfRIRbWqGM+Bi7j54yKnocqdslQe4aoMXycswAoaMszgwpUVbV:FNY0j6RygZj6yKnpqmlx4aDic2oJ3
TLSH
T1AE247D47E2B35CBCDA57C1748257E372BA71B8610234EE7F0AA4DB311D11D607B2AA39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BR89B.tmp

Path C:\Users\Admin\AppData\Local\Temp\BRL00000c8c\BR89B.tmp
Size 90KB
SHA256 150ac0b7099a90f654c070275ede790cd9ad10dedcb537d9730e97d13d56bc1c
MD5 8b866ca087f9c424bdb8caadd124e1e0
SHA1 41832ea2035dbb92db93cff1c6b30a0ea307431f
SHA512 2f977962c8fdcdab1725fda9a3b304a29e9ac977b3589f7d0449be8ea965a32f12fe971cafc0daecad54f0d668dd61f4d5b418249ccd7f6b583a1ef2aacc0d5d
SSDEEP 1536:VF7bWaW4Ct4jdJrnz9vBrqcMTtjqqzTvX5FTpRn6dhdIObIOP:VFHI4pphvBrdMEqzjX5FTph2XNP
TLSH
T116937E576A9761FCC67781B0C2E2CB7AAA30F81015706BAF5258EBB01F11D902F596FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3212-81-0x0000000070140000-0x000000007014F000-memory.dmp

Download

memory/3212-88-0x00000000746D0000-0x000000007470E000-memory.dmp

Download

memory/3212-85-0x00007FFC1D910000-0x00007FFC1D99F000-memory.dmp

Download

memory/3212-79-0x0000000074740000-0x0000000074818000-memory.dmp

Download

memory/3212-87-0x0000000074710000-0x0000000074723000-memory.dmp

Download

memory/3212-86-0x0000000074730000-0x0000000074740000-memory.dmp

Download

memory/3212-84-0x0000000066C00000-0x0000000066C1B000-memory.dmp

Download

memory/3212-78-0x00007FFC26790000-0x00007FFC267B7000-memory.dmp

Download

memory/3212-83-0x0000000067380000-0x0000000067391000-memory.dmp

Download

memory/3212-82-0x000000006CA00000-0x000000006CA0E000-memory.dmp

Download

memory/3212-77-0x0000000066680000-0x0000000066695000-memory.dmp

Download

memory/3212-76-0x00007FFC295B0000-0x00007FFC29600000-memory.dmp

Download

memory/3212-80-0x000000006C580000-0x000000006C599000-memory.dmp

Download

memory/3212-75-0x00007FF7D0A90000-0x00007FF7D0DA6000-memory.dmp

Download

memory/3212-89-0x00007FF7D0A90000-0x00007FF7D0DA6000-memory.dmp

Download

memory/3212-103-0x00007FF7D0A90000-0x00007FF7D0DA6000-memory.dmp

Download

memory/3212-117-0x00007FF7D0A90000-0x00007FF7D0DA6000-memory.dmp

Download

memory/3212-131-0x00007FF7D0A90000-0x00007FF7D0DA6000-memory.dmp

Download

memory/3212-145-0x00007FF7D0A90000-0x00007FF7D0DA6000-memory.dmp

Download

memory/3212-159-0x00007FF7D0A90000-0x00007FF7D0DA6000-memory.dmp

Download

memory/3212-173-0x00007FF7D0A90000-0x00007FF7D0DA6000-memory.dmp

Download

memory/3212-187-0x00007FF7D0A90000-0x00007FF7D0DA6000-memory.dmp

Download

memory/3212-201-0x00007FF7D0A90000-0x00007FF7D0DA6000-memory.dmp

Download

memory/3212-215-0x00007FF7D0A90000-0x00007FF7D0DA6000-memory.dmp

Download

memory/3212-229-0x00007FF7D0A90000-0x00007FF7D0DA6000-memory.dmp

Download

memory/3212-243-0x00007FF7D0A90000-0x00007FF7D0DA6000-memory.dmp

Download

memory/3212-257-0x00007FF7D0A90000-0x00007FF7D0DA6000-memory.dmp

Download