991d59b3ae3ad0e42d7837cb3515479499dfbf2251eb67de647f079e842b390a

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Goodhertz_KeyGen.exe
Size 669KB
Sample260815-2w6ddsvdqa
SHA256 991d59b3ae3ad0e42d7837cb3515479499dfbf2251eb67de647f079e842b390a
MD5 9f8f96ae6768c343836d83a388ac2629
SHA1 e252d5c43fe92570ef189c686afb05e044f49da7
SHA512 1b44b6638f7cb6438084b54c95a7582289f5ebf1c17d1f72ae915f7bcd9bf9b1bfa880814a9ed35cb52503d4427d2b74a7934f90978e6e6980442e33ea657cc7
SSDEEP 12288:4c9t2SllRl5pN3j2lkKeJut+/34JvhjKzHknb20qzKvZV5tZJHi2V87YC:4cLNB3CmJHG6H30YKJtrVe
TLSH
T1F4E4234AF9D408E7E926437015AB8B32233B7F918ABB0597B7D97F355533343601BA82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1328	keygen.exe

Loads dropped DLL 2 IoCs

pid	Process
1328	keygen.exe
1328	keygen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Goodhertz_KeyGen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Colors	keygen.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	keygen.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1328	keygen.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4328	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4328	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1328	keygen.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 1328	3340	Goodhertz_KeyGen.exe	89

C:\Users\Admin\AppData\Local\Temp\Goodhertz_KeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\Goodhertz_KeyGen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1328

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BASSMOD.DLL

Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL
Size 33KB
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
TLSH
T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R2RJUCE.dll

Path C:\Users\Admin\AppData\Local\Temp\R2RJUCE.dll
Size 226KB
SHA256 79951906c0a397cb7afd15f1d3061e7f2f3f95c38ad553ebdb8be2737bfe7277
MD5 50359048673ed27bd174458a863ba207
SHA1 b1c7d5d534d4f5e4ce1c0381e42af4758cb294a8
SHA512 46f83fc6c76d76266292582b25d5893bbf79a1a8196b97e4229b193530f78da4addf1490e776480408cb691712ac100bf3d60586b67dda884592c425d818c338
SSDEEP 3072:Ud6T6B7g4pRxwz7Rjia0Qd4rl+0eZ4vJtW+8AhUKBLyvTBfbxsUx3kwPsnY5gl:7TH4PxwfNAe48D4v/dQTBjjx3TPtul
TLSH
T171349D41B4D0C476CA7F05348CB5EB685ABEB9600F70E9DB67884E6E4E316C0DB3176A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bgm.xm

Path C:\Users\Admin\AppData\Local\Temp\bgm.xm
Size 448KB
SHA256 3ca6cac0a1c9aeccc8d50e6b2a3d53841243093d73a7277ff8d50f22fdf404bf
MD5 db03d639ec385dd9226ac37e657898d8
SHA1 b7ee6204f4474ae3640a6f9a1f7317dfac262c52
SHA512 9fbf76203a5ded8087e6f850bb9d5d3b592ca1a8e0f518302194cf581a64806145dc05656fe09833aa36a641dc8c0228e728eab0f28ddf70111bb013f89ca122
SSDEEP 6144:Yi0wgARFBYu03nw6iFZZob/BT8TThIQSG3IRvuXCUaqVycyxoDvyc:T0wXKib8/tPmIRvuQqVycqorh
TLSH
T16AA409067603E1C1C9AA66B36C2D4785E334E5DBAF21596B2508FD027B9B7CD2BFD084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
Size 493KB
SHA256 bd53e99d44c6e6d4a4daa47e89d7a5bc9d03fbda2ae6274484ab01ed3e668659
MD5 374a4358fb64510c36ab812c4bc196e8
SHA1 89ef238c4c565bfd7427ddb3f9271c31b99a0f71
SHA512 782336cb80fc8394a1479c2ad6630f506256f8c6b7012ba86ea441d266c4d3045870b2946af226a4d25f46525073269067408758997342e651cecf2f929bcf0c
SSDEEP 6144:icmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAO+ELC0zntWBFu9ICxSjLebGw:ic/kEPDonR6Y436vRBLC0ztWBFVCxO6p
TLSH
T106B4804AAE324ABEED70523F91DD554A5906B1F1C2E6C4DF42CB15FA881239E346C3BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1328-19-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1328-23-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1328-15-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1328-16-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1328-17-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1328-18-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1328-7-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1328-20-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1328-22-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1328-12-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1328-24-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1328-25-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1328-26-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1328-27-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1328-28-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1328-29-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1328-30-0x0000000010000000-0x0000000010013000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads