Overview
overview
7Static
static
3Kleinstadt...14.exe
windows10-2004-x64
7Kleinstadt...14.exe
windows11-ltsc_2024-x64
7Microsoft....ck.dll
windows10-2004-x64
3Microsoft....ck.dll
windows11-ltsc_2024-x64
3Microsoft....nd.dll
windows10-2004-x64
3Microsoft....nd.dll
windows11-ltsc_2024-x64
3Microsoft.DirectX.dll
windows10-2004-x64
3Microsoft.DirectX.dll
windows11-ltsc_2024-x64
3NAudio.dll
windows10-2004-x64
3NAudio.dll
windows11-ltsc_2024-x64
3Signalling.dll
windows10-2004-x64
3Signalling.dll
windows11-ltsc_2024-x64
3Update.exe
windows10-2004-x64
3Update.exe
windows11-ltsc_2024-x64
3de/Common....es.dll
windows10-2004-x64
3de/Common....es.dll
windows11-ltsc_2024-x64
3de/Kleinst...es.dll
windows10-2004-x64
3de/Kleinst...es.dll
windows11-ltsc_2024-x64
3de/Kleinst...E].pdf
windows10-2004-x64
3de/Kleinst...E].pdf
windows11-ltsc_2024-x64
3de/Kleinst...E].pdf
windows10-2004-x64
3de/Kleinst...E].pdf
windows11-ltsc_2024-x64
3de/Signall...es.dll
windows10-2004-x64
3de/Signall...es.dll
windows11-ltsc_2024-x64
3de/index.html
windows10-2004-x64
3de/index.html
windows11-ltsc_2024-x64
3en/Kleinst...es.dll
windows10-2004-x64
3en/Kleinst...es.dll
windows11-ltsc_2024-x64
3en/Kleinst...me.pdf
windows10-2004-x64
3en/Kleinst...me.pdf
windows11-ltsc_2024-x64
3en/Kleinst...er.pdf
windows10-2004-x64
3en/Kleinst...er.pdf
windows11-ltsc_2024-x64
3Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 12:54
Behavioral task
behavioral1
Sample
Kleinstadt_3.5.0.14.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Kleinstadt_3.5.0.14.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Microsoft.DirectX.AudioVideoPlayback.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Microsoft.DirectX.AudioVideoPlayback.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Microsoft.DirectX.DirectSound.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Microsoft.DirectX.DirectSound.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Microsoft.DirectX.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Microsoft.DirectX.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
NAudio.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
NAudio.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Signalling.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Signalling.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Update.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Update.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
de/Common.resources.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
de/Common.resources.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
de/Kleinstadt.resources.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
de/Kleinstadt.resources.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
de/Kleinstadt_Timetable_SortedByTime_[DE].pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
de/Kleinstadt_Timetable_SortedByTime_[DE].pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
de/Kleinstadt_Timetable_SortedByTrainNumber_[DE].pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
de/Kleinstadt_Timetable_SortedByTrainNumber_[DE].pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
de/Signalling.resources.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
de/Signalling.resources.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
de/index.html
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
de/index.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
en/Kleinstadt.resources.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
en/Kleinstadt.resources.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
en/Kleinstadt_Timetable_SortedByTime.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
en/Kleinstadt_Timetable_SortedByTime.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
en/Kleinstadt_Timetable_SortedByTrainNumber.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
General
- Target Kleinstadt_3.5.0.14.exe
- Size 12.1MB
- Sample260930-p5mlesff89
- SHA256 38af609ca6d6e40e2feb589d48f99b8b2a28f77d3f4f66ef7b431655ef584223
- MD5 3af45639e527bc6fce278170c47d7cf8
- SHA1 23f297708fa5f3a8db71a58e1a704d401bd651ea
- SHA512 b313966d49a11cf8ba04963f6aa7788a88d0cf08b4d760c55d1534eae1467645d6d960c8d9628e2eac8078e769cd843049e60b804dead149a9999a9472ba7391
- SSDEEP 393216:GuBSqU7FgccrInaodbstBO4ia0gxJ9QdF:xMhBgccrMivFialQdF
- TLSH T157D63317A8F42AC6E2579733A9502665AFF265374DCF4E1351079C2E23370BAEF680B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 4148 Kleinstadt_3.5.0.14.exe 4148 Kleinstadt_3.5.0.14.exe 4148 Kleinstadt_3.5.0.14.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 48 IoCs
description ioc Process File created C:\Program Files (x86)\Signalsoft\Kleinstadt\system_de.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\en\titleimage.gif Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\Kleinstadt.resources.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\index.html Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\titleimage.gif Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\index.html Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\en\Kleinstadt.resources.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\Kleinstadt.exe Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\kleinstadt_data.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\Common.Plugins.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\Signalling.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\Microsoft.DirectX.DirectSound.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\Signalling.resources.dll Kleinstadt_3.5.0.14.exe File opened for modification C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\titleimage.gif Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\css\layout.css Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\de\Kleinstadt.resources.dll Kleinstadt_3.5.0.14.exe File opened for modification C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\index.html Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\de\Common.resources.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\de\Kleinstadt_Timetable_SortedByTrainNumber_[DE].pdf Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\de\titleimage.gif Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\en\index.html Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\Kleinstadt.exe.config Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\Microsoft.DirectX.AudioVideoPlayback.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\Common.Zip.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\en\Kleinstadt_Timetable_SortedByTime.pdf Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\Kleinstadt_Timetable_SortedByTime_[NL].pdf Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\Signalling.resources.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\Update.exe Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\de\Signalling.resources.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\de\index.html Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\en\Kleinstadt_Timetable_SortedByTrainNumber.pdf Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\Common.resources.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\titleimage.gif Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\Common.resources.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\Kleinstadt_Timetable_SortedByTrainNumber_[FR].pdf Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\system_de.dat Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\NAudio.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\Microsoft.DirectX.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\css\base-min.css Kleinstadt_3.5.0.14.exe File opened for modification C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\titleimage.gif Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\Common.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\css\reset-min.css Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\de\Kleinstadt_Timetable_SortedByTime_[DE].pdf Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\Kleinstadt_Timetable_SortedByTrainNumber_[NL].pdf Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\Kleinstadt.resources.dll Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\Kleinstadt_Timetable_SortedByTime_[FR].pdf Kleinstadt_3.5.0.14.exe File opened for modification C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\index.html Kleinstadt_3.5.0.14.exe File created C:\Program Files (x86)\Signalsoft\Kleinstadt\uninst.exe Kleinstadt_3.5.0.14.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kleinstadt_3.5.0.14.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Signalsoft\Kleinstadt\Kleinstadt.exe
- Size 9.0MB
- SHA256 dde5d28bc9d14d9daa5cd0de4b3505bc1b4bc1c9315fc62da421413a8a3cce2e
- MD5 4c2655910e7ec9a7a921ef72268fee3b
- SHA1 dadf2b8f2532046058db1071be19d11ba1c22bcf
- SHA512 cb603ee1fa9ceb9449063384fa2bbc5b1a74de5c6034f70856342107e97c2f200e45855ddd16ec08698f160f02f5931d3ee192a18075f16562822d53174801cf
- SSDEEP 196608:7Es7+I6+YDGPzSx+I6+YD4+I6+YDj+I6+YDI+I6+YDL+I6+YDGk:oA+I6+YeSx+I6+YE+I6+Y3+I6+YU+I69
- TLSH T1A696C520E2518859C13943F258315CA2527FFB29B631C57C284FF27FEAF26269B1275B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj6615.tmp\AdvSplash.dll
- Size 6KB
- SHA256 eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb
- MD5 13cc92f90a299f5b2b2f795d0d2e47dc
- SHA1 aa69ead8520876d232c6ed96021a4825e79f542f
- SHA512 ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3
- SSDEEP 96:6hNSXIcmYjkvTS6MnBNZ1BMjDfhkkEkkXstWpPwoS:JXIpzTSd1BSk/kJtWpP
- TLSH T137C1B837B7C216F7C35600F12916375387E9943263A1946909B3EBCAA6A185BDD34703
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj6615.tmp\InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- TLSH T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj6615.tmp\LangDLL.dll
- Size 5KB
- SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
- MD5 9384f4007c492d4fa040924f31c00166
- SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
- SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
- SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
- TLSH T129C18333B3C24AF5D6950633252373C366539E342359804F9B6712AA69208FBDD6E793
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj6615.tmp\ioSpecial.ini
- Size 632B
- SHA256 8c7108f26ed20c89d2fcbeae2ad3c12d835f42a5147742356dacf59b9fff97f4
- MD5 185f1157a1e772d51eb39feb567913b3
- SHA1 72f429821c8b0e7cc68c76adfe7e73b3adb563ca
- SHA512 1d2b6a8a0d04d862bc4a8b299f10afd912674dafd9465ae55ab32eade49f5b2729fa0d1274536ec91002c039c78785729677548d53c6e97e59176c714f911e9e
- TLSH T127F07D89941A42AA4820524256FB7BA253D02C34472639F1F1228C87A74EDD5C8FEBC2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj6615.tmp\ioSpecial.ini
- Size 653B
- SHA256 9f5803d359394e49e084b9e680a57a7ab4f48708bd12c8d0817327bd0b5581d8
- MD5 e6a11ab44b8caf3751d8da83c1f7af76
- SHA1 5e21de15c80e1f41d4c049c393ba2016995688ac
- SHA512 c572c9c9f2e91991bcf0b14ca1fcd9ed5d8e41e1817b1b58c79e06ff5823a87ebd78802877ce2007172e3b1c1fa923bff63dfab1c897348a9ba62792815731b7
- TLSH T1A4F07389541A429B4820524255FB7FA257D02C34475539F1F1668C87D74EDD5C8FEBC2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj6615.tmp\ioSpecial.ini
- Size 667B
- SHA256 4a7dc6d1beca3cd85152cf4daac1c824dd68f6f477d1d386bc5ee3f714313b74
- MD5 d32dfb880c5c8ef9b5803daf49c6f23f
- SHA1 762bbd3effbccb5aa84e53581cdd67c52357f1a2
- SHA512 5468bd3a2e025445ffefd77e447f9a1e1969a70cd95c904d534ac665e47cb4a9ae78976eb9d55248fdfad76aab668c64273418eea3d384b9c74caf6a6584df5c
- TLSH T1DE019E885019429A4820524255FB7EA253E01C30875639F0F5668C43D74DDD6C8FEAC2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj6615.tmp\ioSpecial.ini
- Size 728B
- SHA256 2d43b161904dace78e5c066b379e39d2bbff7f79cd7f539e905d470da3030813
- MD5 55a003a865b49dcb09ba119bc1b5e00c
- SHA1 4aa405e04b9150601f825b6f17971a4ef1e5da8a
- SHA512 6961cdd200c32c2ef6c9c813a74fcf5449cfb229e9d0699a2259c2091fe2f40990b01ddaa374b36247ce8815d29020236dd2149160c1268a4cb7baf21a08fb27
- TLSH T1DE01C589442F93A4481050D560E937A257D02C6C87213CF6F052C887574DDD38AEEED3
- MD5 SHA1 SHA512 TLSH