b5f52026101317daec58961904d81ee1ebda06f1313ba2900787c00b2c04bd5f

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 11:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ToolkitCo.exe
Size 2.3MB
Sample260905-nqr2xstdjb
SHA256 b5f52026101317daec58961904d81ee1ebda06f1313ba2900787c00b2c04bd5f
MD5 59f965fb0991545e5dd96a037a92cb8d
SHA1 e3e3c1b0df9557fbbbdd783037ff8fcae5759ca2
SHA512 6e184509f38f77d9e35c8218a5b8c738654c372d6129816aa9861e9b5e7d959c169783d4d5b12b332facf5ed02fdcd604f0ade3c80ab7f41b423bb5f5ed90eab
SSDEEP 49152:Lto/cIESFOWTESrM9cXUL8lSHMFFo4rB46x98bOwx:Lto/cBSyFL88Z
TLSH
T118B57D1362844036D07B0A3B4C7FD78C693BBE20AE969D272FA45ECD4E376816C39657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3236 set thread context of 936	3236	ToolkitCo.exe	89
PID 3236 set thread context of 4784	3236	ToolkitCo.exe	90

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\GrelixDataset.job	memu.exe

Executes dropped EXE 1 IoCs

pid	Process
3236	ToolkitCo.exe

Loads dropped DLL 5 IoCs

pid	Process
3236	ToolkitCo.exe
3236	ToolkitCo.exe
3236	ToolkitCo.exe
936	CoreModu.exe
4784	memu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4448	936	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ToolkitCo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ToolkitCo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoreModu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2240	ToolkitCo.exe
3236	ToolkitCo.exe
3236	ToolkitCo.exe
3236	ToolkitCo.exe
936	CoreModu.exe
936	CoreModu.exe
4784	memu.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3236	ToolkitCo.exe
3236	ToolkitCo.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 3236	2240	ToolkitCo.exe	88
PID 3236 wrote to memory of 936	3236	ToolkitCo.exe	89
PID 3236 wrote to memory of 936	3236	ToolkitCo.exe	89
PID 3236 wrote to memory of 4784	3236	ToolkitCo.exe	90
PID 3236 wrote to memory of 4784	3236	ToolkitCo.exe	90

C:\Users\Admin\AppData\Local\Temp\ToolkitCo.exe
"C:\Users\Admin\AppData\Local\Temp\ToolkitCo.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2240
- C:\ProgramData\DidixResearch\ToolkitCo.exe
  C:\ProgramData\DidixResearch\ToolkitCo.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Users\Admin\CoreModu.exe
    C:\Users\Admin\CoreModu.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 648
      4⤵
      Program crash
      PID:4448
- - C:\Users\Admin\AppData\Roaming\DidixResearch\memu.exe
    C:\Users\Admin\AppData\Roaming\DidixResearch\memu.exe
    3⤵
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 936 -ip 936
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ToolkitCo.exe

Path C:\ProgramData\DidixResearch\ToolkitCo.exe
Size 2.3MB
SHA256 b5f52026101317daec58961904d81ee1ebda06f1313ba2900787c00b2c04bd5f
MD5 59f965fb0991545e5dd96a037a92cb8d
SHA1 e3e3c1b0df9557fbbbdd783037ff8fcae5759ca2
SHA512 6e184509f38f77d9e35c8218a5b8c738654c372d6129816aa9861e9b5e7d959c169783d4d5b12b332facf5ed02fdcd604f0ade3c80ab7f41b423bb5f5ed90eab
SSDEEP 49152:Lto/cIESFOWTESrM9cXUL8lSHMFFo4rB46x98bOwx:Lto/cBSyFL88Z
TLSH
T118B57D1362844036D07B0A3B4C7FD78C693BBE20AE969D272FA45ECD4E376816C39657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mssp7en.dll

Path C:\ProgramData\DidixResearch\mssp7en.dll
Size 525KB
SHA256 1a279027ff5df2f3f768b3654a36379a89e44502a1767b1015edade36f0cbfa1
MD5 f91b613690bf25347cfccee6d0f01bd1
SHA1 e3b145859e68cdcb01001bdbfb777d3a732b38c8
SHA512 cf9466fcc186bafa01f382dec887275c736917f5a765d3fa0fc2907b82d76257ef68ae4840a94083e16f6d35fced15e833429374257fe8c81cb05da8c41b0fc9
SSDEEP 6144:ezWzO86Rxpfx4x+y1XxqkEo2z20hqGjZFClx2MOnU1IOW8jPaTw5:ezQtWzKQy1XxqkEfjvO32bOW7T6
TLSH
T11BB49E333081C07AD23E23719D59F27817F9B96299B1A20B7FD8973D2FB15D06626392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

starburn.dll

Path C:\ProgramData\DidixResearch\starburn.dll
Size 444KB
SHA256 8218bda3803fecc05418de4ad951a35673f4a3b51d0ac3584f5a3e4599c6e343
MD5 b171593a23147872cdd2d4250637550e
SHA1 d0c7669ae9b64b247f97c099e41e15626302a8dd
SHA512 2370853e73f427cccbe35b102e1151eb7b31397fd22b92f5e3b9eaee07db4158c3a574674616cea11e38c24d7f3642b54eaa0e08b05b647ce640a6a69e9857a5
SSDEEP 12288:j/gzbnBCGqx8Vw5wTVZs9d2RXkGHwL9sBA+V/2B:7UCGqxeyoXsbo+sBAq+B
TLSH
T1E5A49E22B9A0E873C98209B4464CB735BEBAF470172A81D7774853DEE8293D3AD34757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

448E4C8.tmp

Path C:\Users\Admin\AppData\Local\Temp\448E4C8.tmp
Size 4.7MB
SHA256 f00c7095e98e9b807ecde2db7f31b89348ced4eafdcbc9dc0e36f12d5a7cf530
MD5 d6c6bf5cd73dea626900c2912de5f7b4
SHA1 25319deb7d5a4784940fb24afcd2958a846bbd51
SHA512 1a297e12ea5740b2645cb65d470f04551993e85a8838f60df12415c200e5739c50d8528fe337c8d62b059461cbf19c5f621dc84a29895a68913edaff2d377492
SSDEEP 98304:N+cubIg/+d4+dEZSBmXjGuu/+aJfJJLpPVwylucrJKlw+:Nbux/d+RBmzm/+aO+Klw+
TLSH
T1803633EF13CB98437D79E741591B4A274086EBAB3EBE24D9490098FB85CFF1075A9063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

448E4C8.tmp

Path C:\Users\Admin\AppData\Local\Temp\448E4C8.tmp
Size 4.7MB
SHA256 f50694616f94d1adbee35f6a2c576a82125a69d137cdbf19b797ef64e8af89c1
MD5 6bbf4594973e3e7481f864057893de90
SHA1 169d35f6588d4faad3b51dd905eafc5d3ce04546
SHA512 2d45213241e8bd6333b502b666d7be5b5d07c4f0a92667962fb4addc70eab52e5cd3a3655944f0804158eeccbb7e578c45aa653638acaa4166a9be6d8dc19997
SSDEEP 98304:EtcubIS/+d4+dEZSBmXjGuu/+aJfJJLpPVwylucrJKlw+:EKuz/d+RBmzm/+aO+Klw+
TLSH
T1EC3633EF13CB98437D79E741591B4A274086EBAB3EBE24D9490098FB85CFF1075A9063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

884112A.tmp

Path C:\Users\Admin\AppData\Local\Temp\884112A.tmp
Size 40B
SHA256 5378d452f1020a02d5a0598e9c5f3c9c2e1bb440bb9a427b4bc22753d4bb97e6
MD5 00a95420d66b014b46605d2082fe51f3
SHA1 2faebcedc2977b7dddd23844a3a0d82ba952113c
SHA512 da6eb977e745023236e5c403833fcc5d038413669f5cdce3392450ba1e752f7b83f32503bf83ec090cec7aa3e349d499e8ab39a4ca4cd3dd9bf2d87481518411
MD5 SHA1 SHA512

Submit Download

memu.exe

Path C:\Users\Admin\AppData\Roaming\DidixResearch\memu.exe
Size 323KB
SHA256 6df5e87bfe261f38a5810313c8221c39b5b15206ce672e1a87167edcf82f43ba
MD5 22db418ed5bac1716f440c1e89e9216b
SHA1 d5b0a386edd880c6663fe1cbc0a70af04b1e830b
SHA512 5bcc3c25a46e8ef11383f2a1ac42ce60ddbf6efd7bd702d064dc01e7838b622e64916c01de7b1cab5aab6c10d56ffe9bdb5e37029ac8697d160fecffce08935f
SSDEEP 6144:mOtgZjM7oB12to2h2MWla+TQe9UP6b+X1zX0A:ntgZ4KS2L0q5UPcU1r7
TLSH
T166641BB2E9CC48A8DEA10EF9377CCDA0656ABA70CEB084DB630451751D2B7B0C571D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreModu.exe

Path C:\Users\Admin\CoreModu.exe
Size 150KB
SHA256 1c4c5569a5682fde5d3a3b161c7ce8d94134d7f05984542dd100de9d4bd69c4b
MD5 1d7f99e8b09b7f77d22c74f17560e1ae
SHA1 585f82b4596c0cad16b28ef65cd580491a54d92a
SHA512 cd63a24299d70b00b1fca3e116d29a4c0b29127d6c8c9527bde8c98ce9bb9a11c015192808e246ecd6b037d63495d4e4fd112ba8b85ad8704270b4c3aafc46f4
SSDEEP 3072:8WBpaSg2CYnmz5Gv3buUDYBArmeqtpSveH:8WHaPYQW7A2e
TLSH
T15FE338327FE04072F59A0D7548A667F73937A9708F0823FF8BD4DB25A8306E5653624A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-30-0x00000000007C0000-0x0000000000B7B000-memory.dmp

Download

memory/936-23-0x00000000007C0000-0x0000000000B7B000-memory.dmp

Download

memory/936-40-0x00000000007C0000-0x0000000000B7B000-memory.dmp

Download

memory/936-28-0x00007FFDDF920000-0x00007FFDDFB83000-memory.dmp

Download

memory/2240-1-0x0000000075400000-0x00000000754F5000-memory.dmp

Download

memory/2240-2-0x00007FFDDF920000-0x00007FFDDFB83000-memory.dmp

Download

memory/2240-0-0x0000000000E00000-0x0000000000E74000-memory.dmp

Download

memory/2240-4-0x0000000000400000-0x00000000006CF000-memory.dmp

Download

memory/3236-19-0x0000000075400000-0x00000000754F5000-memory.dmp

Download

memory/3236-9-0x0000000075400000-0x00000000754F5000-memory.dmp

Download

memory/3236-7-0x0000000000D10000-0x0000000000D84000-memory.dmp

Download

memory/3236-21-0x0000000075400000-0x00000000754F5000-memory.dmp

Download

memory/3236-10-0x00007FFDDF920000-0x00007FFDDFB83000-memory.dmp

Download

memory/3236-16-0x0000000000400000-0x00000000006CF000-memory.dmp

Download

memory/3236-15-0x0000000075400000-0x00000000754F5000-memory.dmp

Download

memory/3236-13-0x0000000075400000-0x00000000754F5000-memory.dmp

Download

memory/3236-11-0x0000000075420000-0x0000000075421000-memory.dmp

Download

memory/4784-38-0x00007FFDDF920000-0x00007FFDDFB83000-memory.dmp

Download

memory/4784-42-0x0000000075400000-0x00000000754F5000-memory.dmp

Download

memory/4784-43-0x0000000075400000-0x00000000754F5000-memory.dmp

Download

memory/4784-44-0x0000000075400000-0x00000000754F5000-memory.dmp

Download