Overview

overview

6

Static

static

3

Kontakt 8....er.exe

windows10-2004-x64

4

Kontakt 8....er.exe

windows11-ltsc_2024-x64

6

Resubmissions

28/09/2026, 21:23

260928-z8nb8sdc63

28/09/2026, 20:29

260928-y9jvrsshqd6

Analysis

  • user interaction
    yes
  • max time kernel
    61s
  • max time network
    66s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/09/2026, 20:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Kontakt 8.13.0 Full Options Patcher.exe
  • Size 28.8MB
  • Sample260928-y9jvrsshqd
  • SHA256 e0f0ccd3c32b239c051d4deceacd9ed786823d990eb22ede4675f7890a571c29
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscovery

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

    Adversaries may abuse Verclsid to proxy execution of malicious code.

    defense_evasion
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 25 IoCs
  • Modifies registry class 57 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Kontakt 8.13.0 Full Options Patcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Kontakt 8.13.0 Full Options Patcher.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4376
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x000000000000048C 0x00000000000004F8
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2652
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1772
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2016
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
        2⤵
          PID:4984
        • C:\Windows\System32\SearchProtocolHost.exe
          "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:6000
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 836 2860 2856 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
          2⤵
            PID:3504
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 836 3068 3016 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
            2⤵
              PID:4592
          • C:\Windows\system32\verclsid.exe
            "C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
            1⤵
            • System Binary Proxy Execution: Verclsid
            PID:4916

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                memory/2016-12-0x000001C55B7C0000-0x000001C55BA5E000-memory.dmp
                Download

                memory/4376-0-0x000000000042F000-0x0000000000430000-memory.dmp
                Download

                memory/4376-1-0x0000000000400000-0x00000000020CE000-memory.dmp
                Download

                memory/4376-2-0x0000000000400000-0x00000000020CE000-memory.dmp
                Download

                memory/4376-3-0x0000000000400000-0x00000000020CE000-memory.dmp
                Download

                memory/4376-4-0x0000000000400000-0x00000000020CE000-memory.dmp
                Download