Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 18:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
twoclient_loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
twoclient_loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target twoclient_loader.exe
- Size 925KB
- Sample260820-wrfdhswthx
- SHA256 ea29f2656c035db5381c90ac84b9a9f360e8d2a5780a4fc7505fc546baa671ca
- MD5 0806ca7a35a0df818797f4c322cfb305
- SHA1 718165f3ba88592324324122eb896d88c8fabe15
- SHA512 b4f46c37a0132068dea0c9476e5f24e4fa23dec7cc403c0cf8ef6773cd43defbc9bb1e32ccac7a2775753b49a44bed73de47cbb8d0a95f691ace5445922c7895
- SSDEEP 24576:4sooCOJ+CSWivhizC6Dfiug9nACiqq+rUrJ5d+abaiH3QY:3VSWivGD60CBqTrLd+KH3QY
- TLSH T15815AD10B292D031D56501B1AE3DFBAB553C2C340B21A8DB73E85EAE56E02D37AB1F57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language twoclient_loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UserOOBEBroker_45d918.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2432 twoclient_loader.exe 2432 twoclient_loader.exe 2432 twoclient_loader.exe 2432 twoclient_loader.exe 2432 twoclient_loader.exe 2432 twoclient_loader.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe 5452 UserOOBEBroker_45d918.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5452 UserOOBEBroker_45d918.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 2432 twoclient_loader.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5452 UserOOBEBroker_45d918.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2432 wrote to memory of 5452 2432 twoclient_loader.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\twoclient_loader.exe"C:\Users\Admin\AppData\Local\Temp\twoclient_loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\UserOOBEBroker_45d918.exe"C:\Users\Admin\AppData\Local\Temp\UserOOBEBroker_45d918.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5452
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\twoclient_loader_inject.log
- Size 751B
- SHA256 8e718c1d050d9493bb19de83bdb337ee11173dc7196f1791957fd66f1faffd19
- MD5 1f5fb2001d038d289b024895b180e346
- SHA1 d9c3cabfdfc47fe350c1ce9af817fc9a0948a77a
- SHA512 07c0b651347a881b1934796096b43ae528e3a359ab1a958b3e14a163d0bbfd43b26de1fc772f52e590d5c965551b8066827c5e44d96f7b4fe0e2a4c4696db3ce
- TLSH T17201897A8B85D4943C0280B780BBA8AB986C94037AA1E6106773708EB144A8CEE94333
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TwoClient\hwid.mix
- Size 16B
- SHA256 afd8e01a6aa3e0be3919397e62fd91f6656ebb6a8de65604a692fd1c8080a058
- MD5 6b346e5eb18e1409ee678bf6fa49b9f0
- SHA1 dd6b51b1776651b8032f1845afa751a849c18c05
- SHA512 153cdd0283e73762852345af343d9123f44190067733d3d8e1cd3a2c31d985641f37b85684ac190351f37765c49f0ce3d0c9061622362ffabe447ce99caf4abd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TwoClient\loader\inject.log
- Size 310B
- SHA256 18eded3955b5be9167a077940d661788b0b378460bb710b97e4f9f7fcf6df2d5
- MD5 3bb47c9c18cb369f05b9b70dfc6b0bec
- SHA1 f423df62dd170fe0c0f2e834bd9328751ee40faf
- SHA512 d9d4efcc70b1766926a67e4cf3cb68e3632e374e9cc9095a54d24b30f821c8fd267150d6c8028bebc2cdae88ff89f471ee21479b852bdaf911068d7440fa9da6
- TLSH T15BE0EC7C9BC5E96E290AC07B05BB95DFC0709A0B6E45BB116720B88D618685DBFC5312
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TwoClient\loader\inject.log
- Size 155B
- SHA256 57237cf4793cd5340bd1e25dab29efbe5340d46a85d6d5b419a20946bcb2e364
- MD5 99aee09424d9b75a717238ca27ddfab9
- SHA1 34f094099d43ce66e4cba5d51fe507a1c58065a0
- SHA512 de60f9fcf80aaebba24246fa77af8569d0bf741df0ed7b31dae53328ef705c9a21165901c5bfe36b0129378fb23b94429e83a6f7b77aaa3fea206d7be93505f2
- TLSH T1F1C04C7C97C5E9292906C06B05BB95DFC0609A0A6E45BB145220B44C914685DBFD5212
- MD5 SHA1 SHA512 TLSH