515d4a527b61dbf18d67cd236f84ba37e6325601b0099c7e23f3f44525a58b26

Resubmissions

07/09/2026, 18:45

260907-xd1mzaen9x7

07/09/2026, 18:26

260907-w277aaaf497

Analysis

user interaction
yes
max time kernel
298s
max time network
285s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/09/2026, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SonicAcademy_RSA_KeyGen.exe
Size 1.2MB
Sample260907-w277aaaf49
SHA256 515d4a527b61dbf18d67cd236f84ba37e6325601b0099c7e23f3f44525a58b26
MD5 d8843a38b6012deeca8faf61fe2a4477
SHA1 a45f0b047a860795a0ae0b1eb2fde0a18f359524
SHA512 536d20eab3c4ea763f31b71e00cffd4a9e29f132dd3e4b8bba887e33f15f4174a23750420c49e15f4c63ccafdcd7998d35e2c53bc89ad458e1f33c164af8e0ff
SSDEEP 24576:Wo6cLUZxmyg8dOTm7uqX8uIFuI7+qeeiSJhMX2w0rL+lQgeVk1rfEwr1i:WhAixSTb+yiUNX6QgZ1fdi
TLSH
T14B452311B4644AC3E86AC3B600FF96056B3B6E78DA6A5E1B5368BE35F1F371640072D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4180	keygen.exe

Loads dropped DLL 3 IoCs

pid	Process
4180	keygen.exe
4180	keygen.exe
4180	keygen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SonicAcademy_RSA_KeyGen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	keygen.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	keygen.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	keygen.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	keygen.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	keygen.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4180	keygen.exe
4180	keygen.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4180	4904	SonicAcademy_RSA_KeyGen.exe	83

C:\Users\Admin\AppData\Local\Temp\SonicAcademy_RSA_KeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\SonicAcademy_RSA_KeyGen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4180

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x4e0
1⤵
PID:3960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BASSMOD.DLL

Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL
Size 33KB
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
TLSH
T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R2RSARSA.dll

Path C:\Users\Admin\AppData\Local\Temp\R2RSARSA.dll
Size 136KB
SHA256 13bed07548f65041059f2d93b43719df23c5283d9b8bbddfbf76725a5488595b
MD5 e8655d19b3dd3efe346d611b4df00f7b
SHA1 1241a3ca6ad3482ffdefd3a97b114573dc6a8b72
SHA512 8c6692b0c0a1972deda0eb930016e1c02b129dc56b37db10b4b8e02343e1c4edd0666fef263cfc15887764d88608c12bbe56e0cf17d8368caa91150d029b49d2
SSDEEP 3072:byDKjHM7jtFjGSzqEmkdiioQy5VHUp4Bnh/f55cYEvd2IuCDfypTDlHWWE:bGK7sjtNqMFiVHU0PcYcYIuCDfyXTE
TLSH
T15DD312EDC6A54C36C6DB13B12D8F8ADE8C2D503447BF1FA109011B5F6294664EC1EDEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
Size 710KB
SHA256 8fa29f256dad9db167618f839b1869d2ff48d9d253cb6fbcd9f8cdde585b6823
MD5 d713927fc8d550ccc0a932eabde94fcc
SHA1 b137e2651a97105b7603ba3434fdd17b792adb9f
SHA512 b33a3ede661824e9151b8b4925446247456b016dcce3364ab4ec52556e3f6c24bc815892516233f920789cba45fed572d99dfacde62b2305d0d0256b362d2725
SSDEEP 12288:7Eb6CmonRVnsQ5ogI/U407L4dTHsCXymCn0sTU5EBtpFgg3MUR:7umonR5fG/U40vIHsCnCdUqjQg3MO
TLSH
T12CF4595429DB2DF9D0BFA0FB4D499BB4764E75397A02D4E3B3405B074A242FE0EE1A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4180-13-0x0000000002370000-0x00000000023B9000-memory.dmp

Download

memory/4180-16-0x00000000023B8000-0x00000000023B9000-memory.dmp

Download

memory/4180-15-0x0000000002370000-0x00000000023B9000-memory.dmp

Download

memory/4180-10-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/4180-17-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/4180-18-0x0000000002370000-0x00000000023B9000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads