178ab52ee0ed7925a1027a3ce872020baf50566e7c2f6f31a4b338a61ed78b44

Analysis

user interaction
yes
max time kernel
30s
max time network
23s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NativeInstruments_Keygen.exe
Size 1.1MB
Sample261002-evqvzsty4k
SHA256 178ab52ee0ed7925a1027a3ce872020baf50566e7c2f6f31a4b338a61ed78b44
MD5 de8a12c0db24db60a2f610bfeac45039
SHA1 7aa7885ff8b31f5c947d5d97bd994e8979291bd6
SHA512 49f510ae07743c89c6349f31963ef1e7d78812ab2cb9647838878c74166759639468cd4376e6bc73b5240122377daf061c18af4eaab36bd2a99d2b869f86e22d
SSDEEP 24576:scLyq2JCWJGZSNZq9hRACjb16XtUW3oGny3O4Y92voyhevaXB+ztubmlH:sAZ2JCAWYIDAC/166KR92voyhey0ao
TLSH
T1974523A1ED5094A3C97A47F004A34C6A6AB3BCA977971257368CF739B6733A00C5B347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1556	keygen.exe

Loads dropped DLL 3 IoCs

pid	Process
1556	keygen.exe
1556	keygen.exe
1556	keygen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NativeInstruments_Keygen.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1556	keygen.exe
1556	keygen.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4916	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4916	AUDIODG.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 1556	3256	NativeInstruments_Keygen.exe	89

C:\Users\Admin\AppData\Local\Temp\NativeInstruments_Keygen.exe
"C:\Users\Admin\AppData\Local\Temp\NativeInstruments_Keygen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1556

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BASSMOD.DLL

Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL
Size 33KB
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
TLSH
T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R2RNIKG3.dll

Path C:\Users\Admin\AppData\Local\Temp\R2RNIKG3.dll
Size 286KB
SHA256 b6f5b250f457968fd69711c4919c20b6a96be4e0c7eb73f986d9fe1a541964a7
MD5 73ea66ad9f6a0adf8f2dd768a2fecb06
SHA1 2a310b1a0fb8b9b356166d24a58d8648d2bbe3f5
SHA512 6ea41f971d320021780ba2140ffb93d90c231bd54c542c2099b555a8c9c8bf1bb864b3c3b397524578850edd9f9048e7ffbddeb542376366cb2494e8f674f496
SSDEEP 6144:4EZzoOUiEPhf0PJFMVKD5vZ1iYUKPQVrrJKPoEm9mA0s2mMCr0Pat:4YnUiahMoVKdvZ1iQ4rrJKwpmClQPa
TLSH
T1345423B85F32FDCCD0C3B0BE09D585497D529D2C8F862DCF5584FCAB9C676A4422A06A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bgm.xm

Path C:\Users\Admin\AppData\Local\Temp\bgm.xm
Size 959KB
SHA256 929c62454cc0002fec0e05e740db6dbde9c786ce41c8df4cae4af7f59b19867d
MD5 89e24756b8a453f3f3014ae6d1780498
SHA1 73996327d16954d3062efdd313f0c8927f5a9d8c
SHA512 0797f295dd7baac926d5eb9fcaea58d6658415da30c4cc3100965f4d10f74faeb1b50ebfb48c6b5fd53a03e127ff23111b1bf8c72e5292bd334a769d656e7ffe
SSDEEP 24576:alAC0JkDk9zsIzqnxWx9WXvw+PQZ0870kL8Zz8S4uZdu1ZJIa1JlijE9zEbzbkxd:jq7gwiCXwjLiON77n
TLSH
T16C25C5823B50658DE9FB26704D3EC7C94321FE867E234B8725D5ED1BAE6DAC23D11248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
Size 475KB
SHA256 6fb5fd8e52ea850e880b3156cf1cea37d4e6b13ad03ace95f4fde6e87272da9e
MD5 16edae45b7b49a1a734a3c32260f7fa5
SHA1 a2fb2993ebfd4f47a886fc22fce771256785ae8d
SHA512 74ea23adfc7aeedcc13f752b001ec5ce3ba668abdd4a6efe5718ef518bcaed09a027384b85e5918365eb0082b4348c49aa1be03da2ae97470653b99ef4fbc5cb
SSDEEP 12288:tpGVQ4KQonRBVrzRN2Ua0G0K9R9p1GohBbDWPLdYrLBdMj:tp1QonRBVrz3aQK9Rv1vLbDGZYr1dMj
TLSH
T174A48C166E974F37C45F72FE046138A4B2606C4D2BF06FEB670E179228276EB603552B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1556-16-0x00000000022A0000-0x00000000023A0000-memory.dmp

Download

memory/1556-17-0x0000000000423000-0x0000000000424000-memory.dmp

Download

memory/1556-14-0x0000000002400000-0x00000000024B8000-memory.dmp

Download

memory/1556-11-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1556-19-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1556-20-0x0000000002400000-0x00000000024B8000-memory.dmp

Download

memory/1556-21-0x00000000022A0000-0x00000000023A0000-memory.dmp

Download

memory/1556-22-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1556-24-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1556-25-0x0000000002400000-0x00000000024B8000-memory.dmp

Download