Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 00:17
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
IT-Helper.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
IT-Helper.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target IT-Helper.exe
- Size 922KB
- Sample260910-ak6fgaed67
- SHA256 b0bf1ff14f81bc99be4187d0af40c11f2cb817890ca9b42a92632ef3eb720071
- MD5 f5df6843d35acf7237d2c82aaf7b7203
- SHA1 b94f1000c4296118d9cf08c2e7e780a71343d245
- SHA512 22e66a410109292b933190045298b16405686bdd5c1be1e5bbe2c8feab60069515b554650b0d4c160d5e6b253e9b0c92d83fb4b7f29768e6feb67d3dd678ee24
- SSDEEP 24576:yAHnh+eWsN3skA4RV1Hom2KXMmHaO6MUwB7nSmR5:1h+ZkldoPK8YaO6MUK7SS
- TLSH T126158B0273D68036FFAB92739B6AB20656BD7D250133852F13983DB9BD701B1263D663
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IT-Helper.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1968 IT-Helper.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe 1968 IT-Helper.exe