Overview
overview
7Static
static
3unifying252.exe
windows11-21h2-x64
7$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...fo.dll
windows11-21h2-x64
3DJAPI.dll
windows11-21h2-x64
3DJCU.dll
windows11-21h2-x64
3DJCUHost.exe
windows11-21h2-x64
3NonElevatedDll.dll
windows11-21h2-x64
3RunNE.exe
windows11-21h2-x64
3Analysis
- geolocation tags
cacanadananorth-americatoronto - max time kernel
58s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/08/2026, 22:41
Behavioral task
behavioral1
Sample
unifying252.exe
Resource
win11-20260513-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11-20260513-en
Behavioral task
behavioral4
Sample
DJAPI.dll
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
DJCU.dll
Resource
win11-20260513-en
Behavioral task
behavioral6
Sample
DJCUHost.exe
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
NonElevatedDll.dll
Resource
win11-20260513-en
Behavioral task
behavioral8
Sample
RunNE.exe
Resource
win11-20260513-en
General
- Target DJCUHost.exe
- Size 319KB
- Sample260825-2l4f2swzev
- SHA256 0046ef7c22d104342a2cbac54d035512a80e4bd9d1005547cbf99d7dd4398c86
- MD5 9194a9b0dbe5082c77d5b2ce9d3fbdc5
- SHA1 18f0c900c70b95645c03efa336597556ae5af82e
- SHA512 a95c703c1b2ce6df16c33d3cd304b23fba484b207294e690f2cbcb3e498598d9424e87bda285d115d08dd6c5c0a88880dda0ce07fb7fc59f7ea058f468fd9808
- SSDEEP 6144:gCVzOgdcUJ6KPkMYkYL7CE6oTiV0H+t+fpsLI:kUJ6eklkYiE6SiV0B0I
- TLSH T1F4646C107EA0C732D567217749B9976866E9BC604B6182CBA38C3FEDBE316D17A34307
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DJCUHost.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 5156 DJCUHost.exe 5156 DJCUHost.exe 5156 DJCUHost.exe 5156 DJCUHost.exe 5156 DJCUHost.exe 5156 DJCUHost.exe 5156 DJCUHost.exe 5156 DJCUHost.exe 5156 DJCUHost.exe 5156 DJCUHost.exe 5156 DJCUHost.exe