Overview
overview
7Static
static
3Kleinstadt...14.exe
windows10-2004-x64
7Kleinstadt...14.exe
windows11-ltsc_2024-x64
7Microsoft....ck.dll
windows10-2004-x64
3Microsoft....ck.dll
windows11-ltsc_2024-x64
3Microsoft....nd.dll
windows10-2004-x64
3Microsoft....nd.dll
windows11-ltsc_2024-x64
3Microsoft.DirectX.dll
windows10-2004-x64
3Microsoft.DirectX.dll
windows11-ltsc_2024-x64
3NAudio.dll
windows10-2004-x64
3NAudio.dll
windows11-ltsc_2024-x64
3Signalling.dll
windows10-2004-x64
3Signalling.dll
windows11-ltsc_2024-x64
3Update.exe
windows10-2004-x64
3Update.exe
windows11-ltsc_2024-x64
3de/Common....es.dll
windows10-2004-x64
3de/Common....es.dll
windows11-ltsc_2024-x64
3de/Kleinst...es.dll
windows10-2004-x64
3de/Kleinst...es.dll
windows11-ltsc_2024-x64
3de/Kleinst...E].pdf
windows10-2004-x64
3de/Kleinst...E].pdf
windows11-ltsc_2024-x64
3de/Kleinst...E].pdf
windows10-2004-x64
3de/Kleinst...E].pdf
windows11-ltsc_2024-x64
3de/Signall...es.dll
windows10-2004-x64
3de/Signall...es.dll
windows11-ltsc_2024-x64
3de/index.html
windows10-2004-x64
3de/index.html
windows11-ltsc_2024-x64
3en/Kleinst...es.dll
windows10-2004-x64
3en/Kleinst...es.dll
windows11-ltsc_2024-x64
3en/Kleinst...me.pdf
windows10-2004-x64
3en/Kleinst...me.pdf
windows11-ltsc_2024-x64
3en/Kleinst...er.pdf
windows10-2004-x64
3en/Kleinst...er.pdf
windows11-ltsc_2024-x64
3Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 12:54
Behavioral task
behavioral1
Sample
Kleinstadt_3.5.0.14.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
Kleinstadt_3.5.0.14.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
Microsoft.DirectX.AudioVideoPlayback.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
Microsoft.DirectX.AudioVideoPlayback.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
Microsoft.DirectX.DirectSound.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
Microsoft.DirectX.DirectSound.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
Microsoft.DirectX.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
Microsoft.DirectX.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
NAudio.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
NAudio.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
Signalling.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
Signalling.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
Update.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
Update.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
de/Common.resources.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
de/Common.resources.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
de/Kleinstadt.resources.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
de/Kleinstadt.resources.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
de/Kleinstadt_Timetable_SortedByTime_[DE].pdf
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
de/Kleinstadt_Timetable_SortedByTime_[DE].pdf
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral21
Sample
de/Kleinstadt_Timetable_SortedByTrainNumber_[DE].pdf
Resource
win10v2004-20260911-en
Behavioral task
behavioral22
Sample
de/Kleinstadt_Timetable_SortedByTrainNumber_[DE].pdf
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral23
Sample
de/Signalling.resources.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral24
Sample
de/Signalling.resources.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral25
Sample
de/index.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral26
Sample
de/index.html
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral27
Sample
en/Kleinstadt.resources.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral28
Sample
en/Kleinstadt.resources.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral29
Sample
en/Kleinstadt_Timetable_SortedByTime.pdf
Resource
win10v2004-20260911-en
Behavioral task
behavioral30
Sample
en/Kleinstadt_Timetable_SortedByTime.pdf
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral31
Sample
en/Kleinstadt_Timetable_SortedByTrainNumber.pdf
Resource
win10v2004-20260911-en
General
- Target Microsoft.DirectX.DirectSound.dll
- Size 174KB
- Sample260930-p5mlesff89
- SHA256 2e28c8fb8b87b5ffd1e0ea27710a2e785ef4741a89e4b3c3af726ec63d15a1fa
- MD5 d035348ec8968861af585b7132fe4c7b
- SHA1 877ffdf77b9cdc1be14135cff0b756a231401617
- SHA512 94358b581510c68049ac92990674a6cb495cb8ff005f7fc03696c57ba8b4cb384c5035d9332d0ea39093ba5fa5c8082143896cd2fc7ac24a192520789c707458
- SSDEEP 1536:QP0W6HY2WLuj4eWGolnfI8srFxq1tu5uxMc7q2eFrIuQD+hDLb:2p6HTLEeWvS8Q5uxMc7qdFrIuQD0
- TLSH T12E04740D5340D63FD61E57B059C20B666639408A5322B6EF0189967578FE3CAC83AAFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3308 wrote to memory of 4276 3308 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.DirectX.DirectSound.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.DirectX.DirectSound.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4276
-