Overview
overview
7Static
static
3AllService....1.exe
windows10-2004-x64
5AllService....1.exe
windows11-ltsc_2024-x64
5Emulator.exe
windows10-2004-x64
7Emulator.exe
windows11-ltsc_2024-x64
7launcher.exe
windows10-2004-x64
5launcher.exe
windows11-ltsc_2024-x64
5mkcert.exe
windows10-2004-x64
1mkcert.exe
windows11-ltsc_2024-x64
1payload.dll
windows10-2004-x64
1payload.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
141s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/08/2026, 23:23
Behavioral task
behavioral1
Sample
AllServices_module_v2.0.1.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
AllServices_module_v2.0.1.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
Emulator.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Emulator.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
launcher.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
launcher.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
mkcert.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
mkcert.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
payload.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
payload.dll
Resource
win11ltsc2024-20260709-en
General
- Target payload.dll
- Size 166KB
- Sample260825-3dg4hszfqa
- SHA256 3623c9f52b5915747e31f3bae7b3480e764bd57cc26f42d4fbaf0f3b8b7b0a8f
- MD5 08217e9e638bc77f0c31dd231022f195
- SHA1 e7139169b21a6f6e3bfde97d20b38dd6aa71abbb
- SHA512 da3e4f78b45409b95a494e468d7dccb8ed2aa4addd7fe0b678b88eb4c8c2e92fdaeb85a6bf105c9cf0d71f72fcbc26e4a84cf68515de7d06c69bf499cd0a350a
- SSDEEP 3072:UR7C6goA5oF1fTh3Fg0gIGZuVtFPLKSCgcDea:CCb5onr000aFj3a
- TLSH T164F37D16F6BA407FE9678534C9530905EB727C835790AAEF53900AF65F2B7D08A3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4976 rundll32.exe 4976 rundll32.exe