Overview

overview

7

Static

static

3

keylogger/...er.exe

windows10-2004-x64

7

keylogger/...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    900s
  • max time network
    458s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/10/2026, 16:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    keylogger/ThemeHelper.exe
  • Size 8.0MB
  • Sample261012-vbcf9agx9q
  • SHA256 d77bf9aebbc22abf98692da3383c52e3a6cdbb51a5302288059a848ce561f9d4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
persistence

Malware Config

Signatures

  • Loads dropped DLL 18 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
      "C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2236
  • C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
    C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
      C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:4124
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:2812
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:4548

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\VCRUNTIME140.dll
            • Size 117KB
            • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\_bz2.pyd
            • Size 84KB
            • SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\_ctypes.pyd
            • Size 124KB
            • SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\_lzma.pyd
            • Size 157KB
            • SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\_queue.pyd
            • Size 32KB
            • SHA256 48e76e0ad63f6932b4a77b5819f41c1e7595636ca8d9e824f0943a14b8bb5035
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\base_library.zip
            • Size 1.3MB
            • SHA256 d5158cc3f3fd64209fc375b5951fe38dae9f56e2fedefe16613804d78982573d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python312.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\python312.dll
            • Size 6.6MB
            • SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ucrtbase.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\ucrtbase.dll
            • Size 1.1MB
            • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\unicodedata.pyd
            • Size 1.1MB
            • SHA256 208ee1cd3cbad0828433ca7246b05be2b1ff5569983d27d296c0b38888585488
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 956B
            • SHA256 7302489ebf4cf51fb07e32df9695e977c59630a943167bf42a3d03860d5c6139
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 6f3f0d4e457a0316fd5a029233a70f0302e393cfe3e119f3648a945d639e4d5d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 95a8f1dcba53cfcf39c244cea19009bd0037ff66d399f9fcef6735893556e41d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 81573cfb71f5edc112f67aa8cb35f92fc77076a8f74380d97a72d77e877aa0e6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 3b7f78b4450e37e633e6b2d53b842c49c56ffaaeb597b1ab1b186fed2d64ec82
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 b5a27d9885896b307dce0567d8e9bef143ffb8c4e9febf541f747ccdf7354d05
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 ccd617cc57fdb92b590f2ca847951cf29d9f1afa6e700fc2ba9574bfb095626f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 e44fb53a061eeae97c5f06e73947ba2f3d899ce2a42ecf290dadb0dc76e432c6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 e8c0be353fcf6f1e1b58386d5037ad8eaa3ffcce1e98b31a9bd43e3825e4976b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 49383fbac84bf4da383676777ffd40aadacede12e277e116cf2cae05e8904601
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 f2f3760a52e2e77b7cff28430f186b71161339244189e1f4ab08855c3740462d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 9771fa8f759a4e49f9c320dfc09dbd687522d9eed4b609a95575a17b533f68f3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 f348c37ce963b5c8d2a3d1ee6c358e50e56143aedf6768a4297024365774ca81
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 d920b8252c856365ac5e29853f4a89d8953fd952d62dfbff501990119ce88edd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 3e9a70f6edac15da28e56f6d5adbb8b0c6b9e564bb39d2c9bd34cb776f0df97e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 c6f649269b60d6b4060b0b91cf894fa6c70b80f61945907a7c8d1de2eac228ba
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 2391cd2e5e5284ecbb74b62144c8e1f3a1abf89c0d4e8425015826280d8a4ee7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 ed5d407723afe167006b73e84547ae0af1183722c0dd320d8b22b1e9fc2b04ee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 14efe817a6de9a6861c174990019470b4ad4c334ac30e699150a628477bb9fc6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 6b9bf7c0c902ded7d8241e7a2a97698e92ddad8d89c25a53e2cee1d61406c579
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 5398ee3ae5db0e567368804b43f5a4a402f8cc25b7821dbfa4b5468718d0c284
            • MD5 SHA1 SHA512 TLSH
            Submit Download