Overview

overview

7

Static

static

3

keylogger/...er.exe

windows10-2004-x64

7

keylogger/...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    900s
  • max time network
    444s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/10/2026, 18:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    keylogger/ThemeHelper.exe
  • Size 8.0MB
  • Sample261020-wx2tpsc15z
  • SHA256 d77bf9aebbc22abf98692da3383c52e3a6cdbb51a5302288059a848ce561f9d4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
persistence

Malware Config

Signatures

  • Loads dropped DLL 18 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3352
    • C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
      "C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:5992
  • C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
    C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5440
    • C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
      C:\Users\Admin\AppData\Local\Temp\keylogger\ThemeHelper.exe
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:5676
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4460
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:2540

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d182\VCRUNTIME140.dll
            • Size 117KB
            • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d182\_bz2.pyd
            • Size 84KB
            • SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d182\_ctypes.pyd
            • Size 124KB
            • SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d182\_lzma.pyd
            • Size 157KB
            • SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d182\_queue.pyd
            • Size 32KB
            • SHA256 48e76e0ad63f6932b4a77b5819f41c1e7595636ca8d9e824f0943a14b8bb5035
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d182\base_library.zip
            • Size 1.3MB
            • SHA256 d5158cc3f3fd64209fc375b5951fe38dae9f56e2fedefe16613804d78982573d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d182\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python312.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d182\python312.dll
            • Size 6.6MB
            • SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ucrtbase.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d182\ucrtbase.dll
            • Size 1.1MB
            • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d182\unicodedata.pyd
            • Size 1.1MB
            • SHA256 208ee1cd3cbad0828433ca7246b05be2b1ff5569983d27d296c0b38888585488
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1008B
            • SHA256 1c83744dbbd17e9e5765281913dd54b5e54c3b8e5c30eeabc660a3671210eb91
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 8ebbf9b0971d8260ae790f4921b5bfc0f5ca88be7cc454d32bc8cbf03db4a9b0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 e011eab87447847004f1cf1c11fd9e880e23f753dc93d0e6e33d81317616c4fb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 0d7c43774c32884e842bfcecf00a13f886e8f2d2ba55e0c506bdbeba0d33c3c9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 371176ae46bed2dc7c4b2cb3f62c30609e6a966a10fcf468855e60be421ffe7d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 68d9fe3e20231f20dbb4962fb77f83d7bb836fd714c46386caffa7d134f6e45f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 bc7687404b27ff45837e6dda05a8993b4bd2bf7267fa151f34c507cbade68c3f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 e10344df4eeade0ec88b5648236cfbd64065a87929b5a62227fee65ad10cc1c2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 729e66632955511f3191374a53c43362d97367bf3c3ace25dd6d9c676aa74ff5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 22b5814e7910324a33792f8e52e72038d54c6cf1368aacd2305d455f4b79e232
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 1KB
            • SHA256 327814ff49e904e7bde72e073082c439c876bf68f70c712a8380cb6d71e26c93
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 fda04af30da8eeb121dbcc4372ef0bc4bef421762b30c023b1ac6b108023b60a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 f7713f0e749de8f58a13be6ddf55352e7f0aa21552913fdb9f05847ae872b548
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 0b1269c00e71cb9f897df902dbf3931b23bfac592cd4cba7dd5949a8d8191ed5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 71947af134f1b97451a33eaef23357ac37ab215a0a2015bcfe285ba36b0bb9df
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 35041329b44355291fe7d80ce99af7c102042bd6e3544b5ce90426c790269c4f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ThemeCache.txt
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeCache.txt
            • Size 2KB
            • SHA256 1d396b597d6b5ca1b226f829fc1dc01c9bb9c793bd707dd0bfb98768dd33c4e9
            • MD5 SHA1 SHA512 TLSH
            Submit Download