Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/10/2026, 14:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
app.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
app.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target app.exe
- Size 6.6MB
- Sample261026-rbcv8ss18n
- SHA256 2d9763adde3317ffe66f50fa103c28fde2609a978015d921c04b2a53db2309ae
- MD5 861d1649d83f950cae0666ad89910332
- SHA1 ac64fe477fcb087831e19da30e0506b16f7a0531
- SHA512 41d5f812e0f5737b0395f3943a88f1dfcbf874b2201937a7d3bd1ce2f3938a4b0adae03837febe0e54a1695302b7c2a71c8b2c712098c970fd1bbb2446185f1c
- SSDEEP 98304:d24WTWxAg+VcjMb+TiB9uum+72S4ItFioQ:CeAgcATTi/NJ4AQ
- TLSH T197660243F319CAEEC501EE72829FCF04637578AA9A80428BB5AA6E15FD1F1D12D171CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1876 app.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{2AB0B441-971E-4E58-9047-4F840CCC0683} app.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1876 app.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe 1876 app.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1876 app.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\FatalityClicker\cache\ic\interception.dll
- Size 11KB
- SHA256 ab88164c11b1b48488772d4c3bfaa4509d5b0ae9dbc5a691dc4f96f0260443c8
- MD5 fe8b2a022297aa36a3546391221f635a
- SHA1 346e04907eb628372f459fbbf109b6cff57cac13
- SHA512 fa203db607cb1154f7ac84e64b236b19ff29abab1b443609648ee3fafa53581c22420edd1f5ed2c522ab7f3c2577c73822eafbf143a8c80914a3061193b10a1c
- SSDEEP 192:wBKz1mGyRWIddjlkuSCqPDKSyFVzhveZhAk3M+j4sreC:EKsGyRhdtlkuSCLS8VcZhP344
- TLSH T14F320856EBBD107DF497D1F89AE61606E9713A00076563CF01709AAC18A3BD6D73B312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\FatalityClicker\configs\default.cfg
- Size 283B
- SHA256 8ef4c89f9703e9037da3b7b97861a6ecf72a8c1e31aec53e7a2e0aaffbaa915c
- MD5 e1d134892bff852d974a638313cc02d4
- SHA1 bfbf4ed9d3639948e3be675233addc55fa47f55b
- SHA512 db753e84dced6a352971d8c576207c6f030dd53723a0c704e343925ab04bd9fe69ed3715a272f070532f5448c3569f79b6785cb09ddd5c1166aacdee753e05fc
- TLSH T142D017B3F51411A9B2DC9C3CA87AC20307D42F49122B7C8D8A8B1424204F73172B0BC3
- MD5 SHA1 SHA512 TLSH