Overview
overview
8Static
static
3IK_Multime...en.exe
windows10-2004-x64
7IK_Multime...en.exe
windows11-ltsc_2024-x64
8$TEMP/BASSMOD.dll
windows10-2004-x64
3$TEMP/BASSMOD.dll
windows11-ltsc_2024-x64
8$TEMP/R2RIKM2.dll
windows10-2004-x64
3$TEMP/R2RIKM2.dll
windows11-ltsc_2024-x64
8$TEMP/keygen.exe
windows10-2004-x64
3$TEMP/keygen.exe
windows11-ltsc_2024-x64
8Analysis
- user interaction
yes - max time kernel
898s - max time network
340s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 10:04
Behavioral task
behavioral1
Sample
IK_Multimedia_Keygen.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
900 seconds
Behavioral task
behavioral2
Sample
IK_Multimedia_Keygen.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
900 seconds
Behavioral task
behavioral3
Sample
$TEMP/BASSMOD.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral4
Sample
$TEMP/BASSMOD.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral5
Sample
$TEMP/R2RIKM2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral6
Sample
$TEMP/R2RIKM2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral7
Sample
$TEMP/keygen.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral8
Sample
$TEMP/keygen.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
900 seconds
General
- Target IK_Multimedia_Keygen.exe
- Size 431KB
- Sample260910-l4eyea1fqb
- SHA256 7aa7df9e468b053347bc480832633f929335d2ac3c975ceab5d1151a85e66fcf
- MD5 00b671bf194915859242160269e3eeb1
- SHA1 720fd8cee3f9554aee603264aab15a77933c4e1b
- SHA512 6fc6dd6cdc5fd70883116f78364dd0e4512389152d4b51535ee5c476c00a84b89627a1ddda6f6e685de4f03a82f41f3fdecbc3dd45eb09279aa625fb23ce88c2
- SSDEEP 12288:Uc9t2SllJrR9HGqGOl8eLNK2IN6+WDExz:UcLjVZGqT3xK2c2U
- TLSH T139941242F4848AD3DC5B0B7548EFC960227B7E598662168B67D9FF3D62B3393401B683
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4948 keygen.exe - Loads dropped DLL 3 IoCs
pid Process 4948 keygen.exe 4948 keygen.exe 4948 keygen.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IK_Multimedia_Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language keygen.exe - Modifies registry class 33 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" keygen.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 keygen.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell keygen.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff keygen.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff keygen.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" keygen.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff keygen.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell keygen.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" keygen.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 keygen.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 keygen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 keygen.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg keygen.exe Set value (data) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" keygen.exe Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" keygen.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ keygen.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4948 keygen.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4948 keygen.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3260 wrote to memory of 4948 3260 IK_Multimedia_Keygen.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\IK_Multimedia_Keygen.exe"C:\Users\Admin\AppData\Local\Temp\IK_Multimedia_Keygen.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\keygen.exeC:\Users\Admin\AppData\Local\Temp\keygen.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4948
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x414 0x4701⤵PID:4072
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL
- Size 33KB
- SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
- MD5 e4ec57e8508c5c4040383ebe6d367928
- SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
- SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
- SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
- TLSH T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\R2RIKM2.dll
- Size 6KB
- SHA256 f0daf110506df054c349be136157fca6b534bc36b6029fbd112ce9fea5772bce
- MD5 5ab745c63015a8f7ad2e352f3e27ffa6
- SHA1 451f220317dcd0e1693d0c2c53bf504ba5021393
- SHA512 604959c4521a79adcd217e3a97ae480bfdccdfec05e77342b3ecf092606188ef0268c247739af1030dcd4358b7a6a6a4dfa4f689a773b4a049d18c3d6c40a531
- SSDEEP 96:kLEVBzMjDWUymEi2A4PT88aU7a/9aDHJnHI3CWuhlvC5/iBwD35:PhyatiIT8/U7WaJHIKhlvC5/+o5
- TLSH T180D14BFAD1E245F2C56143FD09528B1F97ADA10C43A05AB2A3A1850D6EC2E73E793087
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
- Size 604KB
- SHA256 213c390e325bf4d981f5193a17ee5fb975ea290a9bff15c33848ed597306f632
- MD5 9e6a1763f7d6f88efcfb3e094b4f584f
- SHA1 86aa35e71cc1a49090acabc103aabd61abb676b0
- SHA512 c4efbf8b3932bdbd9b5423737da352dc36a6170c36d282041c1a29b63f35219573cf65c1aa7b2c0988dd6fedfeba7238a5c820a59ce27638114f5b55a4ed2dca
- SSDEEP 12288:bc/kEPDonR6Y436vR61eyf5Q+GItobsBTompObr:SLonR6Y43jL4r
- TLSH T1BDD42A90B552DABAF7E29130C0AD1601FAF166B4632468CFB5CDE5DE88319E0F5A07CD
- MD5 SHA1 SHA512 SSDEEP TLSH