2cace92f028b8318184414f494d668a132c47a82fdd2c8b4594dfa02572d112a

Analysis

max time kernel
40s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kryoto-Desktop_0.2.29_x64-setup.exe
Size 12.6MB
Sample261024-vcadaaa12x
SHA256 2cace92f028b8318184414f494d668a132c47a82fdd2c8b4594dfa02572d112a
MD5 78d9bfd0dd71818d5314255f4d0e600d
SHA1 9ad41d1ae1a42d8f412b3be6a6ade35528ee3cee
SHA512 a268b00dc924c8046cc3091e8062f908145dffa3744ecc6dedfeed59f26968c6929a928eddab4211d28483a8c2cebd101bfab822bc9d13db3bf70b39d30cc754
SSDEEP 393216:f9bWX/fPdvKUqmJYXiHtfem+oiPwYdKEZL157BMSyf5eFmkSh:fIP54mJvHtcoNhEZLHBM/TkSh
TLSH
T1B6D633CBCEC7D692E73710337F91550A72197BC7C11068A2EE7AA97D1AFC14898B3225
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
5140	Kryoto-Desktop_0.2.29_x64-setup.exe
5140	Kryoto-Desktop_0.2.29_x64-setup.exe
5140	Kryoto-Desktop_0.2.29_x64-setup.exe
5140	Kryoto-Desktop_0.2.29_x64-setup.exe
5140	Kryoto-Desktop_0.2.29_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kryoto-Desktop_0.2.29_x64-setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5140	Kryoto-Desktop_0.2.29_x64-setup.exe
5140	Kryoto-Desktop_0.2.29_x64-setup.exe

C:\Users\Admin\AppData\Local\Temp\Kryoto-Desktop_0.2.29_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\Kryoto-Desktop_0.2.29_x64-setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messages.json

Path C:\Users\Admin\AppData\Local\Kryoto Desktop\extensions\ublock\_locales\no\messages.json
Size 47KB
SHA256 0d4e74692de894bec7c8429b7f736a0c77eb23ecf405acd742dd7c727f7c8943
MD5 38bafaa85ff56cbbf21c64f9db7e1f34
SHA1 f4334bf5f98fc49d265435373cfafb6fdb0887e2
SHA512 0b123c005a6758b4237da00da48e15d56f9913b44d08fb5538272a5987856a1edf6e0c2f329ac3d1985861deed0530e898b47992e5dcdb6e09a57335baf15e75
SSDEEP 768:AZMtctAflBff3kw+AcY/bRAuwwos8dmyaWS2yH7UZN5bzt:NtcmflB33kw+uUtsyaW9ybm5bx
TLSH
T10D236700CD607D7B12DE026A7CA66145A37446DF29647C2E7EC9518C1B8EEFAC5BF388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mf.png

Path C:\Users\Admin\AppData\Local\Kryoto Desktop\extensions\ublock\img\flags-of-the-world\mf.png
Size 104B
SHA256 36205cafac511e247037dd09011fd9b94cc2bb0d724126f33001aa3a2f881795
MD5 43f7a094f3d9985b5a991f153a6e6f57
SHA1 488b80fed8e4e7e50fac9a5bfd4bc4229c32c8e6
SHA512 a12a528f7b17e5ee751754f6001b1446bca0d38f35eb15f87ed274cee2483831b6349d37810f4fe00f9115313713e83d954693099d405b6d7d7265ec4b8f3cd9
TLSH
T199B092E38650AD2689A616F362C41082A925A10D4A2A88879C09E96A1322040D1E4E25
MD5 SHA1 SHA512 TLSH

Submit Download

no.png

Path C:\Users\Admin\AppData\Local\Kryoto Desktop\extensions\ublock\img\flags-of-the-world\no.png
Size 122B
SHA256 638e1624f582db031b322834adb6b294e2166f0d1c79cb9e46240f6141693af3
MD5 738f193e16e354a4f9d70cdf4c6f5ebd
SHA1 b0a5a5ddfb3d04273d884bba12e9bf96452cb763
SHA512 deb0e4118cfc30f8b1ef87388bdc3436f8c709879e18a5c5c5f4749164b0f0376ad9454b1224993dfb6e13e284ac211ebd3697319e05e34dbc04a3116c02b599
TLSH
T15BB022E302203CB2EABA022B828C0022EB208A2C02A28E2B8000C22CA080000C288202
MD5 SHA1 SHA512 TLSH

Submit Download

us.png

Path C:\Users\Admin\AppData\Local\Kryoto Desktop\extensions\ublock\img\flags-of-the-world\us.png
Size 539B
SHA256 94fd8fe9e14e5dfc64014bbbeb458be24047f8053c38a6cd1a05f64c6d4ec7f9
MD5 f5c73038cc497ac72a66ea2805acd591
SHA1 8aa24809988d278834127badcea890f0da89129a
SHA512 59ec3e89511167ff23b5f64c9ff8a8c49db9013ad1e7f93311e57db1e2ba03510093b1d5838da266a0ec389f77ac53f024f275f47f21f2ada7126272f3891700
TLSH
T179F075DA0F123132FE14A594087013B6E9C0AC540982C765241D0EFC32633D865D4EAF
MD5 SHA1 SHA512 TLSH

Submit Download

kryoto-desktop.exe

Path C:\Users\Admin\AppData\Local\Kryoto Desktop\kryoto-desktop.exe
Size 39.9MB
SHA256 8f6200791f2bf373e6139d466506341af373da2ad36c31bf8c9994d8088e3557
MD5 1ec240dee83f1719ea12fbddaf0ab78f
SHA1 b8eaafc20d9734f17caa075771442b9e7891e13f
SHA512 4e281bbc3821dfa1d6a607863896235b40f4f5ac8bf868984754386fe56feda5787a3db4d1b300c797a0cd7ef7af0fb37d6659aa1accd3acf266ea96eecaf736
SSDEEP 393216:m8NTsQK2fW1hwkC48OVwD9YS5wweGLadrFrVcVfqsTn1tEZNWmEVzRy:m8NTsQK2fW1hwkC48OVwD9YS5wLGGAn
TLSH
T188971865BA5A5968D09BC474834B86635E3030DB0B35AAFF448496383F7EBF46F38358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh2E6B.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsh2E6B.tmp\modern-wizard.bmp
Size 150KB
SHA256 1518d442c5447c5e9d8f612833a1c605b860f0a39140691c94c3f7f653f868a6
MD5 1c5a4cd31696afae074bab8ab852558f
SHA1 0751b75539e27e23b2a7edb2040db07e884dafb3
SHA512 bcb8e7224f9a816a46a99a3c8167b8ca7534c66c31b2e68a0f7c9d388def9b1431f0a6c08dbdbdf6e42f7ed0228ad4cf2c45b78727a870cb71bbda2e8da738d0
SSDEEP 384:Whyf9yfOEWfOErfOExCEb5LxyKKXJ4FpJH+eNA6u5AAeRZBIoYBTTTTTtVzAFyJ:oAsZ7Gh4Mp+0cCbrBIoEk4
TLSH
T153E34093B114F8CF37968D35C8A09F3286E471FE92A6146EBDDD17BCA44E6302616F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh2E6B.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh2E6B.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download