Overview
overview
8Static
static
3Oxymorphaz...4).exe
windows10-2004-x64
1Oxymorphaz...6).exe
windows10-2004-x64
Oxymorphaz...4).exe
windows10-2004-x64
1Oxymorphaz...6).exe
windows10-2004-x64
3zararlı/h...86.exe
windows10-2004-x64
salinewin1...ty.exe
windows10-2004-x64
3salinewin1.5.exe
windows10-2004-x64
Analysis
- max time kernel
899s - max time network
472s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/10/2026, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
Oxymorphazone (x64).exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
Oxymorphazone (x86).exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral3
Sample
Oxymorphazone-safety (x64).exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
Oxymorphazone-safety (x86).exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral5
Sample
zararlı/hydrogenx86.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
salinewin1.5-safety.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral7
Sample
salinewin1.5.exe
Resource
win10v2004-20260911-en
General
- Target Oxymorphazone-safety (x86).exe
- Size 122KB
- Sample261018-rlrgdabc89
- SHA256 429463bf6f19019407793d8c823c59f189ad0a807c6fa47f9c4a6580ba3cdd3d
- MD5 df3d60c77cfda021f90ceecc0f14d88e
- SHA1 955b78b1009bf3b910853ea500fa6cc7e23c8ddc
- SHA512 b175d4a863527ee4b36cdcbd1f4ac0f9fbc7aac74c1de4a3ec31c8396761a009e802bec11a9dd9b133b3e719ca76b94df75ccb87075e4168de194dcc45c30ea1
- SSDEEP 1536:ESBHiNoHYEfsFek32GDyFvW8ZjJ3QIvKtTC2YprWgpnszWg7QJAsWxcdrwHA6yFO:7iWnZJA4KTC2Yrs7w5rwAFxKh5LJ
- TLSH T1A4C35C01B4D599B2E5B2097114A5DBB65D3EFDB00B594BBB23D4262F6E280C31C37E63
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oxymorphazone-safety (x86).exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2684 Oxymorphazone-safety (x86).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Oxymorphazone-safety (x86).exe"C:\Users\Admin\AppData\Local\Temp\Oxymorphazone-safety (x86).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2684
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a8 0x2fc1⤵PID:2424