ad414bb930e862469a8a7682d0f06738614e68dc1bcbff04d60636c5af919ae9

Analysis

user interaction
yes
max time kernel
24s
max time network
28s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
StealthInject.exe
Size 82KB
Sample260919-t1985stbkh
SHA256 ad414bb930e862469a8a7682d0f06738614e68dc1bcbff04d60636c5af919ae9
MD5 d3aa06f5eac36058f34803f249e2d9d3
SHA1 8edaa5a570e12d50f0bff3befc764b83d79ab0df
SHA512 507b7f3df58679f5ae61d2fb19d9776bb2a4b31849241122a4ba18dc5bb8bf11584065b997cbd8950dbe774b9daad766310b1626c480e92099ee32ecf8ff3756
SSDEEP 1536:8sGDlZtNx5N471AEGEJNj1U0CZPC2GzDLzcxHG9sWjcd5XwKN:ij5RJ3PNHx5XTN
TLSH
T105837C12B6D0C4B1D5B3063149ACCB614A7EFD366E759DA7B388120F5E781C0AA36B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StealthInject.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5736	unregmp2.exe
Token: SeCreatePagefilePrivilege	5736	unregmp2.exe
Token: SeShutdownPrivilege	4516	wmplayer.exe
Token: SeCreatePagefilePrivilege	4516	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4516	wmplayer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 3828	4516	wmplayer.exe	92
PID 3828 wrote to memory of 5736	3828	unregmp2.exe	93

C:\Users\Admin\AppData\Local\Temp\StealthInject.exe
"C:\Users\Admin\AppData\Local\Temp\StealthInject.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4132

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:5736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 512KB
SHA256 bc1e78e95c0c0a2a319923aee81f3e6455b71dbf5782fd78c896daecf7c87082
MD5 6c3eeb7218fedcd43c21d36fec578a2a
SHA1 459be522a986b1cd555533916523bf6893363740
SHA512 4ac490c94a26569b56d11796dbabd4dffc8ce0a3bd3adfe0edda927eb2baa88ff389e9b25c56bf41ec4e653762ca782b3b8dd4d3184591bf5666643d5c36414e
SSDEEP 768:Df0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3:D69tQeoVYoUxYCutFC
TLSH
T12CB41037A560A098DF3C35B1E2AC5F4CBD72650B12E006421F74B57F7A237D98A0B5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 a65bb92b1669d1af59919aba0f14ce0b894f96004cd283a614b0c1db81aa1e15
MD5 168f532deb1ef1c62870ec17428e4a42
SHA1 e9a9c2bc46e0c117efa5dfba4856656113e74d20
SHA512 743050b94801dd69fb3e18e3ac23d0e4b8892760162849c4dc1e2c49f56a312f33edc87ce39fc0ded4bc9e4e6def8fe80b378a9cd44dad220485f25e9f2b75c7
SSDEEP 768:10aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaM:zZP2tFP3vqY8GqEM6TaBacg
TLSH
T1EA257437D190B0C5CE2C7171E9ED8F09BA23B10B11A052465FF8A57E7A633D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 b31998615832d984ef02467ca590fa7c275065694a4172bf76f5bc6558f30582
MD5 fb13cc5ccd80add39b39e5332594eb09
SHA1 ba19d88adcf1604a3f026c434c5ca3b57ce67116
SHA512 697ab4252e63f91d6e3af084b03044589c6a4cc7a7b98a575af3c7ba36ae254a69cb93a7768adb6747eae5a988a3292a257016cf99b95bebed7dbe326d888b20
SSDEEP 96:iOqBcK1lt7NXtoUMUstm7XtTUMbstUUMlstROXtiL2tjLXtJt8AtQt:iO5BnKnRni
TLSH
T1B563CD182AE55649F3FB6E716AFA55175F3A3CA15E39E20C0354424E0C71F29EE30B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 252aff282622b1f0f14eab6dbf7e5661aba64caca8677e758bd1cade47869209
MD5 a1495f706873b398a267bf7225fd367e
SHA1 36b6e661c53f40e632b0127bf0b016a3ea426040
SHA512 842108d75cc7e28b40acd8a319b5173c88438bac08f75ba3b528d4f6a7d33c119d8adcd14aa0f3a8e0725879fe2309107a3f62b0d232822bbaacd70fbd74f428
TLSH
T121215A574A09E8B5CDA247B358CC8A2773B6A7CB5354D02573CAA01A884113E273D17D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4516-33-0x0000000007200000-0x0000000007210000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads