Overview

overview

7

Static

static

3

keylogger/...er.exe

windows10-2004-x64

7

keylogger/...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    900s
  • max time network
    336s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/10/2026, 23:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    keylogger/ThemeHelper.exe
  • Size 8.0MB
  • Sample261020-239z6af141
  • SHA256 d77bf9aebbc22abf98692da3383c52e3a6cdbb51a5302288059a848ce561f9d4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
persistence

Malware Config

Signatures

  • Loads dropped DLL 18 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4756
    • C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
      "C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2016
  • C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
    C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5176
    • C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
      C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:3220
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5308
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:4012

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012942\VCRUNTIME140.dll
            • Size 117KB
            • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012942\_bz2.pyd
            • Size 84KB
            • SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012942\_ctypes.pyd
            • Size 124KB
            • SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012942\_lzma.pyd
            • Size 157KB
            • SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012942\_queue.pyd
            • Size 32KB
            • SHA256 48e76e0ad63f6932b4a77b5819f41c1e7595636ca8d9e824f0943a14b8bb5035
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012942\base_library.zip
            • Size 1.3MB
            • SHA256 d5158cc3f3fd64209fc375b5951fe38dae9f56e2fedefe16613804d78982573d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012942\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python312.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012942\python312.dll
            • Size 6.6MB
            • SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ucrtbase.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012942\ucrtbase.dll
            • Size 1.1MB
            • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012942\unicodedata.pyd
            • Size 1.1MB
            • SHA256 208ee1cd3cbad0828433ca7246b05be2b1ff5569983d27d296c0b38888585488
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1008B
            • SHA256 f9f5c6b55ae1c7ff44dceff288e017496a20cf37347d647aee2095f16f589ff9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 52a70f4805c13bcbd85d330dc6892cd28c43eba13a33dfc452b9a09f4508a830
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 08a331db5cdf49a7b41af44d1efb29990de8588d2c05d6a2cc407feda33baeee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 661b47b627c1dfb8ee1c1e43f686b318aeba1832bd9a27f05b4ccd769243ceee
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 df8453d091d346d654c667e83b1af19ef5a47a701223d9a7e5a8d60082eb9929
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 a5ba413e028a66440d55ec09fdcd02c8148309f15bd5c096a2bd2b37c235f965
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 7ecd79d81d86fc8c6d0c26c2ee4e406f9ac09ed9e9e033683b63b236672b183d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 c22ee8e76391769e5eb45637e4a93fe4bd45fc25054766bb8537007e94b86b90
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 c727c0ac6ac76ff37afd0bc6f0e6cf4c4f76bbbb832a98684a17dedd84e51c55
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 ca42517c1f57fe9092240d5b70a5d4a236f35cd6dcdad274c761042a32996c69
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 92d2e316001e36f7c64178ce86ddc07b95a7969ec870f253d8d2d8c46582aca3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 e8677434d05bd635e0ad22566af9fce5cf18c23e83f70d1239d7e9a49ed24d10
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 3dbe49245ff908705343075e7d7941af37229db3767e973d0437df7eb7468b29
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 0c2f9b0e6b01da2b52bd854720eecae44b72d9a3d935bbbacdb9d9bbc32440c1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 d8115bbb9ae9255f82330cbdc51d4ddc8cd0e495debd3efe458e097b502faf76
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 564023a8a1c26e91699e4bcc7156dc0973e75aa8e353595fa2d50abfa9121627
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 9294fee0db25727722cad9e88fae5edc4687d85b71847e737320534d43b42bd0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 7c76ac81abbfc31c51879d46b16544824616987ddb66c079c7aeb02d99d53961
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 ce38034cd55e0b40ff395877813604dedb6e1edd8c52b53c0703cc6278f8762c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 62c19c7cf8d3218fa9dbc04b3c606cc2d66510febe6572434425f391bf7cdb1e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 aa6edd49a1b4280f4df5978c71b8ae10ca149bc12e1cbdbd07d2673c77456ae0
            • MD5 SHA1 SHA512 TLSH
            Submit Download