Overview
overview
5Static
static
5Bin/Files/Patched.dll
windows10-2004-x64
5Bin/Files/Patched.dll
windows11-ltsc_2024-x64
5Bin/Files/...le.dll
windows10-2004-x64
1Bin/Files/...le.dll
windows11-ltsc_2024-x64
1Bin/Files/...on.exe
windows10-2004-x64
5Bin/Files/...on.exe
windows11-ltsc_2024-x64
5Zynova.exe
windows10-2004-x64
5Zynova.exe
windows11-ltsc_2024-x64
5Analysis
- max time kernel
144s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 12:37
Static task
static1
Behavioral task
behavioral1
Sample
Bin/Files/Patched.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
Bin/Files/Patched.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
Bin/Files/ZynovaModule.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
Bin/Files/ZynovaModule.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
Bin/Files/emulation.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
Bin/Files/emulation.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
Zynova.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
Zynova.exe
Resource
win11ltsc2024-20260911-en
General
- Target Bin/Files/Patched.dll
- Size 21.5MB
- Sample260930-ptpxeaycmd
- SHA256 d6f60d53135dfc351c65936f99739bb3349d2d17474eeaf8d53d2d8474c73848
- MD5 53242f23486a77471a3a039c642024b3
- SHA1 144c456414ed34c0ee2472ab7dc8612ba8d147d1
- SHA512 cc54dfe267db1491af99b488dfabf47988619aaab942457d289d48e1596f8dbe6c2552a61802013cbbc3e7dd9a1a8d81d3e1d34c9bb4797b6f74565b6b9f0f7c
- SSDEEP 196608:xHHpfdBLwIb6MvbVBOGWE0ymAcKtbidzvSApDC:xpfwLlydJtWC
- TLSH T10C37CF4EF8D60AE4D17250B1E55F56D3EA66304C4A6C2EB783D90320367369EB248F6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 3 IoCs
pid Process 4880 rundll32.exe 4880 rundll32.exe 4880 rundll32.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4880 rundll32.exe