Analysis
- user interaction
yes - max time kernel
24s - max time network
21s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
30/09/2026, 13:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
D3DHost.exe
Resource
win10ltsc2021-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
D3DHost.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
General
- Target D3DHost.exe
- Size 39.9MB
- Sample260930-p9d5vazeka
- SHA256 fbc0742ecc3fe42db0b0b4e97978b0dff94b1f76ad6d6c8f7a0df19708011fca
- MD5 0899ff423a18d0e1ab301b040adbaa39
- SHA1 352bc61d1622f778d893759c4b595a2cd1937b8a
- SHA512 19ff6aa3528a2acfece0f2d07562a234f1659892ef7eefa726ca1d3516ac81b975f8020b9ce17e57f2ad3d64f2eb3dbfe0637b2483289be73e798523c381cf9e
- SSDEEP 393216:p9J7vSDIdDyDxJXmUI7/t8g8NDQ7mbDfB1fI8RAC4uGnKFdu9CwJsv6tBN9QP4kS:pkEgH3RA73bQP4kd
- TLSH T15A979E5762E511D8D16BC079CB27C517FB71B80A1330ABDB21A4A6692F73AF12D7E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2704 D3DHost.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2704 D3DHost.exe 2704 D3DHost.exe 2704 D3DHost.exe 2704 D3DHost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2704 D3DHost.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2704 D3DHost.exe 2704 D3DHost.exe 2704 D3DHost.exe 2704 D3DHost.exe 2704 D3DHost.exe 2704 D3DHost.exe 2704 D3DHost.exe - Suspicious use of SendNotifyMessage 7 IoCs
pid Process 2704 D3DHost.exe 2704 D3DHost.exe 2704 D3DHost.exe 2704 D3DHost.exe 2704 D3DHost.exe 2704 D3DHost.exe 2704 D3DHost.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2704 D3DHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\D3DHost.exe"C:\Users\Admin\AppData\Local\Temp\D3DHost.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2704
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\settings.ini
- Size 1KB
- SHA256 e36aa2f0ffc1a7306fc7812354a4dbe8a792aeab0eaac7d23769ccfaf908e9ff
- MD5 a5b980775eb1ec36fc19ce2c7ef15609
- SHA1 6b2ed88f1fe152485db06d0bbb4054b501ba444e
- SHA512 9e731b2d9eba568fa442cad00461facbb89223ad0634a58440435170c5a5134b63cd824d5ddc8a0bf40b7cb4b07463b8f63456949fb3f384e736ad98e62fd955
- TLSH T11711A2BC6B1061A9B08EF732C7A2957235B21FCC643B6030D8C5505C6CBCE85E0B7175
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\settings.ini.lock
- Size 60B
- SHA256 2ffce17d63ae4a1386abfe1272c92b6eefee0594a4f7c16933c22cdaea2bcdc8
- MD5 bfb6230b1f0cc304e09588d9e7d9a196
- SHA1 ef41ccb360c21d0d352fa967ac09a07140549f1b
- SHA512 2dc1558fd29719f8fff49e835bf9da6d0f65cfbf05f7762d3a5900a64a409a888cca9204afb3747bbd34131bcdb723da1867dd9ce031195fcfcdc4092aa856a3
- TLSH T1C7A0026A9835768955479062049908C4654F14D4755022504AD877052BE641E56916BA
- MD5 SHA1 SHA512 TLSH