e277e4b05efdfac9373765fa4038bd475f75c9fe8d4646d2807395cb4f789773

Analysis

user interaction
yes
max time kernel
24s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OVS.Client.exe
Size 95.9MB
Sample261003-vxv6gstbnd
SHA256 e277e4b05efdfac9373765fa4038bd475f75c9fe8d4646d2807395cb4f789773
MD5 5bb0a5ae4c0b8c76ead5381dcf17727d
SHA1 c4724e3e7407a9e91121835b545cb09725a7c940
SHA512 b368c7083e3872e7fa0127860190b153a18518cadf67894873539ed84be71a360ff4a10f524b411f85df4b7afc1d84a16dcb174b40090c868c52beb6fd759191
SSDEEP 786432:xhUNoFI+UoleeeyFJaOH0n5ff5PC1Paa986Pqli3:xGeFIXOFJcZogCGi3
TLSH
T1F628BF11F3D84A1AD17FC27CC2678512E7B1B4821361E7CF0594EAA92F63BD16B36362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
52	OVS.Client.exe
52	OVS.Client.exe
52	OVS.Client.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OVS.Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OVS.Client.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	6100	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6100	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
52	OVS.Client.exe

C:\Users\Admin\AppData\Local\Temp\OVS.Client.exe
"C:\Users\Admin\AppData\Local\Temp\OVS.Client.exe"
1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
PID:52

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004FC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

av_libglesv2.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\OVS.Client\-cIClvLVMlSo\av_libglesv2.dll
Size 5.2MB
SHA256 9b203e40323b49dad29546a52b8b67d200bba8ff4cab9709a79cede23ba847d4
MD5 11a4a07f31e4a91fff678c019b7736af
SHA1 9912e11aa9c351be136474e0d0975e7964b1e124
SHA512 4197cd706c7abb4782f05ba73177a018299365060c6368305b030f21733f3209545bc7d8f61968c79b24088ced4acc4eda92044821fb8347c3370bc6925a4bf1
SSDEEP 49152:FJ2uagzq2YgAoS2tNydAOlzwn56aCqQ2iUAqC2rCnsZ1LT/Tq2XEoxEf6m8s47eF:9PTjAurCnsZ5T/lXEonmn56AL
TLSH
T104467C03F39690DEC409D2B9874B8622F776B88507257ADF229497242F77FD06B3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libHarfBuzzSharp.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\OVS.Client\-cIClvLVMlSo\libHarfBuzzSharp.dll
Size 1.7MB
SHA256 eb76238c9e8e41d44b5a5b18167c4c5b39ca5db4277af5dbe92d730f0fc14a7d
MD5 e0c86bbd88d6b8f5643c1ab1c050a4ee
SHA1 f6c72b1fd89d0f9e3d7825a0450ae0c0af092c5a
SHA512 023a1054d7516ebb99b46ca3f9a17b1ee00e55a46356586513fdd45c42bd6ccca16139a8e93e7a9bc533afa5abed121cb5fd40474bfb27bca22da3598ebef694
SSDEEP 49152:MG+tDvarn9O+3KVv/s0upzEpOqw8k25Pj4LneMdTaGVW:FS2be5Pp
TLSH
T1E3859E4AF2AA10E9D9BFC074C666950BE7A274050314DFEF65E08A95EF23EF5167E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libSkiaSharp.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\OVS.Client\-cIClvLVMlSo\libSkiaSharp.dll
Size 9.0MB
SHA256 9a0d95e8caaa852c70d085af6a40a744242172ad9ea3fd6bc7599875a8a1dbcd
MD5 ef1fabce43fe32ca83260481253f5476
SHA1 ad988af9826e5aacc7b8e5ed6d220b229d70060e
SHA512 f73b56742e43b169177ff49f639c50f98a417f91175c70f7348bde1c7570c2838c181a59b628b003eb2618d75da920a449a724cccaec1dae8b9a80d5aac386f6
SSDEEP 98304:4GKXmtfLM9j2KAdTzwlrdyc8HgGTngmY6+o/:cXmlLMvGsIaGjb
TLSH
T19B964A03B66B64ACC04AC474834B99665E2038CB0B35BCEF52C5A1393FB9BF46F79615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads