Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/08/2026, 15:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MegaDumper_Slayed_Slayed.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
MegaDumper_Slayed_Slayed.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
MegaDumper_Slayed_Slayed.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target MegaDumper_Slayed_Slayed.exe
- Size 171KB
- Sample260820-smzd2sszhy
- SHA256 0c3d5594986584e831f4f0eca3d8a6021f65ee4b86cae78419409e596008e379
- MD5 89a0dbc4c603d8c6565a9e78f49eaf70
- SHA1 b5fd5f34187ba99408c204846c9d603d6779ab11
- SHA512 da94ebb06688d893e12ed48e3e52357df6f317c54367c1616648b271c245e05c5bf7b4ed07b52c79122e27a5bf61dbcee395b83dd60aefae44d3f10b6fa3d023
- SSDEEP 3072:iArtwMWnZh9OC3Oc93DPJZ2F+SS1CA6PDdoKtXik3VUkRhubykt:iuxC3Oc93rJZ2Q56PDdoKZiySkGyk
- TLSH T18A043B25B3A85D23D0BE4BB52873550087B5BA07543FD3ED1D9290E92FF2F808A52B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MegaDumper_Slayed_Slayed.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe 588 MegaDumper_Slayed_Slayed.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 588 MegaDumper_Slayed_Slayed.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 588 MegaDumper_Slayed_Slayed.exe Token: SeDebugPrivilege 588 MegaDumper_Slayed_Slayed.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MegaDumper_Slayed_Slayed.exe"C:\Users\Admin\AppData\Local\Temp\MegaDumper_Slayed_Slayed.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:588