82b38456cf80306542fdbb9229a1fcd41a6be6e801836236c737ad327fa9e163

Analysis

user interaction
yes
max time kernel
100s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FabFilter_KeyGen.exe
Size 555KB
Sample261017-hefa4adf33
SHA256 82b38456cf80306542fdbb9229a1fcd41a6be6e801836236c737ad327fa9e163
MD5 2bbd096a02e68977b40f50de0c243d76
SHA1 90b1814d8226c52a784ee10ec0dda55fd4358af1
SHA512 64f597d6679e445107fe7f51ac158fd660e112cd3d09f260b5bb17b4f20cadc0b33f1464ad922600ec7f0fa9086b4463b62a2006ec003e87f389298370042ab8
SSDEEP 12288:4c9t2Sll8OVj0dtua3okXtdtyHcGdR53c2UD+rH3C+72cK:4cLqOVj+ikddtyHcGdRdZUD+rH3ZXK
TLSH
T1F7C4124AFA908AE3CC67033554BFC661767F7F08A6332547A695BE3C56732836023693
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4992	keygen.exe

Loads dropped DLL 2 IoCs

pid	Process
4992	keygen.exe
4992	keygen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FabFilter_KeyGen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 4992	3680	FabFilter_KeyGen.exe	85

C:\Users\Admin\AppData\Local\Temp\FabFilter_KeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\FabFilter_KeyGen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4992

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x33c 0x240
1⤵
PID:888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BASSMOD.dll

Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.dll
Size 33KB
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
TLSH
T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R2RFBFKG.dll

Path C:\Users\Admin\AppData\Local\Temp\R2RFBFKG.dll
Size 91KB
SHA256 3245c4c10193826bdd307af6f8208c4d7c8e3c8d41d31eaa0f7eeb34f3d339dc
MD5 d9e603d8b6056c2e73c6afaee27e826f
SHA1 632dff14f090c79720ad75671a29f4b9e4f30a06
SHA512 a24916717e186d603069fa37fa7e189ca454a3faefa02b2fce762da03f5c16bb26baabac19d120d51c77c6fe5bb3ee611862e538a287d1169d8ac548471c6976
SSDEEP 1536:M3euQcS481WVHln9bzuaZbibbb+S4A3JO:DuQcS48WzRzu/rO
TLSH
T1A49349513492F371D53A117C735A47630F7FE5B52222E8EB8BB80D4A5A22BC3CF16692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
Size 1.0MB
SHA256 f6445a70dacb174d81cb012315c03c4d529fbd5fc514e072708684d3b7e095f4
MD5 d1dffd39a24e6dbb3900009ca1ce9138
SHA1 eb5cd9718e9ac57e824a03f16f8538b80597149e
SHA512 85a026daa45efa8bda31cc7d7a89b82a1159a2c9e02213c0a0e48cb319b47ca688939d4f9afb2b3acbe43bfe262cd0aad53812497e7596c4fe92a7d7bdfa1339
SSDEEP 6144:icmzikEPDonRgNgz1+hw6hNgPfHv9PAimIAOHEz43YeGO0SUewdczU4OSX9szyhX:ic/kEPDonR6Y436vR2zLOLezyhqMH
TLSH
T1F825A143A160F76FDB62C075D0AD7E319011A63D3B2297A7CE68BF7F841A491A5FB210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4992-6-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4992-11-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/4992-13-0x0000000010000000-0x0000000010013000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads