Overview
overview
7Static
static
7Daemon.Too...59.exe
windows10-2004-x64
7Daemon.Too...59.exe
windows11-ltsc_2024-x64
7$PLUGINSDIR/Aero.dll
windows10-2004-x64
7$PLUGINSDIR/Aero.dll
windows11-ltsc_2024-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows11-ltsc_2024-x64
3DTAgent.exe
windows10-2004-x64
3DTAgent.exe
windows11-ltsc_2024-x64
3DTCommonRes.dll
windows10-2004-x64
3DTCommonRes.dll
windows11-ltsc_2024-x64
3DTHelper.exe
windows10-2004-x64
3DTHelper.exe
windows11-ltsc_2024-x64
3DTImgEditor.exe
windows10-2004-x64
6DTImgEditor.exe
windows11-ltsc_2024-x64
6DTPro.exe
windows10-2004-x64
6DTPro.exe
windows11-ltsc_2024-x64
6DTShellHlp.exe
windows10-2004-x64
3DTShellHlp.exe
windows11-ltsc_2024-x64
3DTShl32.dll
windows10-2004-x64
3DTShl32.dll
windows11-ltsc_2024-x64
3DTShl64.dll
windows10-2004-x64
7DTShl64.dll
windows11-ltsc_2024-x64
7Engine.dll
windows10-2004-x64
3Engine.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/10/2026, 17:29
Behavioral task
behavioral1
Sample
Daemon.Tools.Pro.Advanced.v5.3.0.0359.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
Daemon.Tools.Pro.Advanced.v5.3.0.0359.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Aero.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Aero.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
DTAgent.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
DTAgent.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
DTCommonRes.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
DTCommonRes.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
DTHelper.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
DTHelper.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral21
Sample
DTImgEditor.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral22
Sample
DTImgEditor.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral23
Sample
DTPro.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral24
Sample
DTPro.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral25
Sample
DTShellHlp.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral26
Sample
DTShellHlp.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral27
Sample
DTShl32.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral28
Sample
DTShl32.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral29
Sample
DTShl64.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral30
Sample
DTShl64.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral31
Sample
Engine.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral32
Sample
Engine.dll
Resource
win11ltsc2024-20260911-en
General
- Target Daemon.Tools.Pro.Advanced.v5.3.0.0359.exe
- Size 8.7MB
- Sample261001-v2mpxaself
- SHA256 098d808c4303c3ce26cc69c60035a3c0178911fccda25c09101503c07cb9660a
- MD5 64bdc989bbf35d2ed5b5274bbb440e36
- SHA1 259780f07b39b32993d9955148d4650bf15cb868
- SHA512 9a7aecf1ee1f5a20b2d65ef6de755025dd689a3ade401ee0c4fa136856627aad50b441acd9efbd9ab80b323e09cae9609bf6b7ce4a54d7f0ec03b056260920ca
- SSDEEP 196608:YNGQW7TFD9xBNGYDrpIcCx9ODniMn8KxBta9yMTrA:Yb8RDpkYHiA2aZBc9Lo
- TLSH T1DA96336A98DCDBD9F2E138F5702B9D86167335759CE6E46B83C321083FB91832DA4B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000d00000001c49c-11.dat acprotect behavioral2/memory/4152-14-0x0000000074330000-0x0000000074339000-memory.dmp acprotect behavioral2/memory/4152-24-0x0000000074330000-0x0000000074339000-memory.dmp acprotect - Loads dropped DLL 3 IoCs
pid Process 4152 Daemon.Tools.Pro.Advanced.v5.3.0.0359.exe 4152 Daemon.Tools.Pro.Advanced.v5.3.0.0359.exe 4152 Daemon.Tools.Pro.Advanced.v5.3.0.0359.exe -
resource yara_rule behavioral2/files/0x000d00000001c49c-11.dat upx behavioral2/memory/4152-14-0x0000000074330000-0x0000000074339000-memory.dmp upx behavioral2/memory/4152-24-0x0000000074330000-0x0000000074339000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Daemon.Tools.Pro.Advanced.v5.3.0.0359.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsz8025.tmp\Aero.dll
- Size 6KB
- SHA256 b19961de6ca07e08704d6372718542f70dbbb203e59bf9bbe3a58f6e069a625c
- MD5 869c5949a10b32d3a31966cc5291301b
- SHA1 329080c974d593ecdefd02afa38dd663a10331c4
- SHA512 3b9dde16e9ca803b1048243dbf29c717ac0472dffa764542c234318a960828834aa650b1dfb8bba66c4e7a9ce3aaf453829afc57dfb33dc8c311d203150d4fca
- SSDEEP 96:AdxrhBuDBzndge+Kwv7KzxsJBuEGQKq+5okMU+S0767ZJG:IGB+Bh78xsPLGQKqEokSS0e7ZJ
- TLSH T19EC12A4577F8113EE0AAC73295AB062B7178BC40C7FB5AED0C0E145B38312908D89B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsz8025.tmp\System.dll
- Size 11KB
- SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
- MD5 bf712f32249029466fa86756f5546950
- SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
- SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
- SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
- TLSH T1DC3229328B60C1F2D561C274496B3A3367B9761420B04D67DFB78446EC16AD66E3E327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsz8025.tmp\nsDialogs.dll
- Size 9KB
- SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
- MD5 4ccc4a742d4423f2f0ed744fd9c81f63
- SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
- SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
- SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
- TLSH T1DE121A636694D5BBC2D2123736A53752CBA92338F0265C05CBB78E867D646C57E3A302
- MD5 SHA1 SHA512 SSDEEP TLSH