Analysis

  • max time kernel
    60s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/10/2026, 14:06

General

  • Target
    Redragon_K652-RGB-PRO_Setup_V1.6.6_20230324.exe
  • Size 3.4MB
  • Sample261006-relybacs4j
  • SHA256 dc3a5b77cddf5e671d58c1e74e11163c20c7c8ecae4af2bacb5e6ffc7a040e0a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 63 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Redragon_K652-RGB-PRO_Setup_V1.6.6_20230324.exe
    "C:\Users\Admin\AppData\Local\Temp\Redragon_K652-RGB-PRO_Setup_V1.6.6_20230324.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3112
    • C:\Users\Admin\AppData\Local\Temp\is-QPCFM.tmp\Redragon_K652-RGB-PRO_Setup_V1.6.6_20230324.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-QPCFM.tmp\Redragon_K652-RGB-PRO_Setup_V1.6.6_20230324.tmp" /SL5="$400A8,3164327,213504,C:\Users\Admin\AppData\Local\Temp\Redragon_K652-RGB-PRO_Setup_V1.6.6_20230324.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5364
      • C:\Program Files (x86)\Redragon K652-RGB-PRO\KeyboardDrv.exe
        "C:\Program Files (x86)\Redragon K652-RGB-PRO\KeyboardDrv.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:3040

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InitSetup.dll

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\InitSetup.dll
        • Size 55KB
        • SHA256 72f5cfe575253eaff31e27ce8f70b4caaa079d2c42a4130515eecf7f0967115d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KeyboardDrv.exe

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\KeyboardDrv.exe
        • Size 2.0MB
        • SHA256 5aaa81905ec3afb82060803ed4437333668a3273ffd443875bd1e7bef1abfaac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appico.ico

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\appico.ico
        • Size 75KB
        • SHA256 198d4e89686b1ee8cd23d602229ef31360c5eb5f134969d9a5b7ac083169aa19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cfg.ini

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\cfg.ini
        • Size 6KB
        • SHA256 03556291ef8371e3906b29ae53785696ef057ad965d2fff72dcf9a7e6380eef4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        btn_nr.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\btn_nr.png
        • Size 2KB
        • SHA256 08381c6a2df82875f53e318a0eccb6e5bc1feb5acc2cda47a09464448cae0ab1
        • MD5 SHA1 SHA512 TLSH

        btn_ov.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\btn_ov.png
        • Size 2KB
        • SHA256 597e0ab3e0acf2002fcce2230d31998ef841014183a6e88a9fa1ab756dfc584e
        • MD5 SHA1 SHA512 TLSH

        button_dn.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\button_dn.png
        • Size 2KB
        • SHA256 667ab0fe0c2bb99506789ab50b10a6977a74f623d7080b01574c67ebf9dc2f56
        • MD5 SHA1 SHA512 TLSH

        button_nr.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\button_nr.png
        • Size 2KB
        • SHA256 15ec287db50c6966ba97d0c4f4ccfe954bdff25e5e9cfb4feaa645b01f288af0
        • MD5 SHA1 SHA512 TLSH

        color.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\color.png
        • Size 3KB
        • SHA256 6f3a9337f02545fff4749c6be09647149a295d1507304beed08e902c78c337fa
        • MD5 SHA1 SHA512 TLSH

        exit_nr.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\exit_nr.png
        • Size 3KB
        • SHA256 a801af805c6ee627fb9bc26449ad832cb1b3136378010d359599222c06a7c310
        • MD5 SHA1 SHA512 TLSH

        exit_ov.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\exit_ov.png
        • Size 3KB
        • SHA256 9a325a47bdeb48a97b2446312ec813c0f9186bf0cb78b36f87dbd54f6852e638
        • MD5 SHA1 SHA512 TLSH

        is-BOUTR.tmp

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\is-BOUTR.tmp
        • Size 3KB
        • SHA256 27066a6d29fd62982a02e72c1c4e5f6b3f6e18fe8598abea96f3a8a2852f4df9
        • MD5 SHA1 SHA512 TLSH

        is-P6U7U.tmp

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\is-P6U7U.tmp
        • Size 2KB
        • SHA256 c651f7c8550ea5fec0e195f397dd4e345468356be3e90c3f0770842dbe11ee25
        • MD5 SHA1 SHA512 TLSH

        is-SFIG3.tmp

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\is-SFIG3.tmp
        • Size 2KB
        • SHA256 56ef3a325a86aec24f2a9f5daba1b1df4ecf24c6af1bf64774c0735e779d1646
        • MD5 SHA1 SHA512 TLSH

        keyimg.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\keyimg.png
        • Size 208KB
        • SHA256 6e42b96e1481089a1bf52ced5e2359b65746707ce7a70499f93c539d0401e5bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lbtn_nr.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\lbtn_nr.png
        • Size 3KB
        • SHA256 321a35f192e962ddba8d1b4756a3e045b2d98b6c781689e83c791e75af3a732e
        • MD5 SHA1 SHA512 TLSH

        lbtn_ov.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\lbtn_ov.png
        • Size 3KB
        • SHA256 1da5178839a71f1fc6bfc1c6480015b5f305df5d5e8e0bde607c1ae567670f7f
        • MD5 SHA1 SHA512 TLSH

        main_nr.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\main_nr.png
        • Size 549KB
        • SHA256 1eb27d3d2d5fca36016cccd9f2aa67e6dd56b42aa96655c1cf1e025d5ae612b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mak.skn

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\mak.skn
        • Size 520B
        • SHA256 ef26a214e6831d58c06afea636df3e3fd51483fa4ee3e78a96c709c45b222692
        • MD5 SHA1 SHA512 TLSH

        menu_nr.bmp

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\menu_nr.bmp
        • Size 11KB
        • SHA256 4b920a134ffef15c5f46938051e122c673365f6a86fe56801671801147ac09d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        menu_ov.bmp

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\menu_ov.bmp
        • Size 11KB
        • SHA256 8582b236f8d66eefac8be56cad74c8605dab54dc2b0476210836b79803a12dbc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        menusub_nr.bmp

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\menusub_nr.bmp
        • Size 11KB
        • SHA256 12a58b47e9619007717a15fb8fc70ad2c7a19adcaad20ec6d849111d8d25025b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        menusub_ov.bmp

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\menusub_ov.bmp
        • Size 11KB
        • SHA256 346219caabd1a0b7ceffaaf604f04c46c343ac8589c5dc25062c97b0b0ccea39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        min_nr.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\min_nr.png
        • Size 2KB
        • SHA256 73310a6b2b74477e79ab37df8213a9884d9aa7da5feef1db14bd0eccfdfb1c9e
        • MD5 SHA1 SHA512 TLSH

        min_ov.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\min_ov.png
        • Size 2KB
        • SHA256 aed40270574ec64f02709c8f8287850ba56d184b98e8d9c21dc52ab3bebab0a1
        • MD5 SHA1 SHA512 TLSH

        msg_nr.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\msg_nr.png
        • Size 92KB
        • SHA256 7170781a0cebe40690cf855b1a77613be21ee100d208dbb1ab3fd46f097a92a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rbtn_nr.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\rbtn_nr.png
        • Size 3KB
        • SHA256 f99b2ad97fc7dfb8a52879450d4305f6d38d096642986110c1e2f2c5130fe5ab
        • MD5 SHA1 SHA512 TLSH

        rbtn_ov.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\rbtn_ov.png
        • Size 3KB
        • SHA256 19d49b11532efe7ba415eecca73a2d6885e7605cd1536d84a13fb8594fd4da85
        • MD5 SHA1 SHA512 TLSH

        rcolor.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\rcolor.png
        • Size 40KB
        • SHA256 1bedd0b2f77236ca6981f6ce8a238d4092e62b56151c80e561527681d3a82809
        • MD5 SHA1 SHA512 SSDEEP TLSH

        slider.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\slider.png
        • Size 3KB
        • SHA256 e0d952b9352e02a79569661417ecb8ce900a2662e2d22632dd0f6091e0c38449
        • MD5 SHA1 SHA512 TLSH

        text_nr.png

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\skins\text_nr.png
        • Size 3KB
        • SHA256 f3b1e96c590af2ea2ba35d049e154c16999423b573c402e84fa6a4b2064bcce9
        • MD5 SHA1 SHA512 TLSH

        text.xml

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\text.xml
        • Size 18KB
        • SHA256 9d559950665b472197f667b5c1df240ac5015f62246f976af988f163a6ccd673
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unins000.exe

        • Path C:\Program Files (x86)\Redragon K652-RGB-PRO\unins000.exe
        • Size 1.2MB
        • SHA256 b321c17094b37eaa42d5701ac8c3f1cb5831c06c466326113e93566b1ca8c26c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lang.ini

        • Path C:\Users\Admin\AppData\Local\RedragonKB\lang.ini
        • Size 20B
        • SHA256 2c5451afc3ee4f44c5dbf63d07377485ecfa52a024ac869f0ee113c9c1cf59f0
        • MD5 SHA1 SHA512

        Redragon_K652-RGB-PRO_Setup_V1.6.6_20230324.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-QPCFM.tmp\Redragon_K652-RGB-PRO_Setup_V1.6.6_20230324.tmp
        • Size 1.2MB
        • SHA256 79b327db4ad8e17493570635de727d7171008e14249c075d48acbb420a492df0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/3112-2-0x000000000041E000-0x000000000041F000-memory.dmp

        memory/3112-0-0x0000000000400000-0x0000000000440000-memory.dmp

        memory/3112-16-0x0000000000400000-0x0000000000440000-memory.dmp

        memory/3112-242-0x0000000000400000-0x0000000000440000-memory.dmp

        memory/5364-18-0x0000000000400000-0x0000000000548000-memory.dmp

        memory/5364-8-0x0000000000400000-0x0000000000548000-memory.dmp

        memory/5364-13-0x0000000000400000-0x0000000000548000-memory.dmp

        memory/5364-15-0x0000000000400000-0x0000000000548000-memory.dmp

        memory/5364-20-0x0000000000400000-0x0000000000548000-memory.dmp

        memory/5364-231-0x0000000000400000-0x0000000000548000-memory.dmp

        memory/5364-223-0x0000000000400000-0x0000000000548000-memory.dmp