Overview
overview
10Static
static
5OP-5.zip
windows10-2004-x64
10OP-5.zip
windows11-ltsc_2024-x64
10OP-5/NO-5.exe
windows10-2004-x64
10OP-5/NO-5.exe
windows11-ltsc_2024-x64
10OP-5/d3d9core.png
windows10-2004-x64
1OP-5/d3d9core.png
windows11-ltsc_2024-x64
8OP-5/libcef.dll
windows10-2004-x64
3OP-5/libcef.dll
windows11-ltsc_2024-x64
3Analysis
- user interaction
yes - max time kernel
899s - max time network
857s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/10/2026, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
OP-5.zip
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
OP-5.zip
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
OP-5/NO-5.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
OP-5/NO-5.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
OP-5/d3d9core.png
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
OP-5/d3d9core.png
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
OP-5/libcef.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
OP-5/libcef.dll
Resource
win11ltsc2024-20260911-en
General
- Target OP-5/d3d9core.png
- Size 3KB
- Sample261026-rlxcmaxsg1
- SHA256 de00dc70c1f4760b3ff1d6b1d188cc9aab77a31a1c576ca8fe14fffd6a9934bf
- MD5 804f78545b3a17b358ac7ebd2f4daf91
- SHA1 82f35453aa36d54ec6cb2956e76c009c7077a5aa
- SHA512 e2226917c1d9a5cd20e67598eab1bf8261cff49124055b6f3da129261cf59a1463414f9da1fd05e56027d5013da71de57932d4b8ea756d2235106df6a3b4d362
- TLSH T1AE615B71309542EEC29A194D485C994750A93ADEF3FD1A19FCE2CFA4125B411D1AC5FC
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4628 mspaint.exe 4628 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4628 mspaint.exe 4628 mspaint.exe 4628 mspaint.exe 4628 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\OP-5\d3d9core.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4628
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:5332