Overview
overview
10Static
static
5OP-5.zip
windows10-2004-x64
10OP-5.zip
windows11-ltsc_2024-x64
10OP-5/NO-5.exe
windows10-2004-x64
10OP-5/NO-5.exe
windows11-ltsc_2024-x64
10OP-5/d3d9core.png
windows10-2004-x64
1OP-5/d3d9core.png
windows11-ltsc_2024-x64
8OP-5/libcef.dll
windows10-2004-x64
3OP-5/libcef.dll
windows11-ltsc_2024-x64
3Analysis
- user interaction
yes - max time kernel
1080s - max time network
1080s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/10/2026, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
OP-5.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
OP-5.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
OP-5/NO-5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
OP-5/NO-5.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
OP-5/d3d9core.png
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
OP-5/d3d9core.png
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
OP-5/libcef.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
OP-5/libcef.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target OP-5/libcef.dll
- Size 11.6MB
- Sample261026-rlxcmaxsg1
- SHA256 f8515b0e2a68b677a105ed438062223ac91e61c7796bd6cd83089e1b0591016b
- MD5 122ca07761bd2aadc59f3f344e95aabf
- SHA1 fb6fe73aeff1377b6c1f0b5819f93821be1e207f
- SHA512 d8c33aeb72e6010fa2a67ab69c9ca2b4f2c6225514d53278338c3ac1f74481b89ca56ff8ab1489f24e0e22e53fb73735c4ddc310180c83c7585660e5967f6f20
- SSDEEP 49152:oWQQFCSewjuBfaBpYc47VNR5xBJB/mPLNjUISv8TrVoVAvJE6b8cr2piTZei7aTn:95DyBSBCDVNRoTNoyvhrzav1F3V
- TLSH T1D0C649F2654B73ACC29BCAF3A02C0444364699D112E949F3E5C47A74AFEFD99E214336
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4692 taskmgr.exe Token: SeSystemProfilePrivilege 4692 taskmgr.exe Token: SeCreateGlobalPrivilege 4692 taskmgr.exe Token: 33 4692 taskmgr.exe Token: SeIncBasePriorityPrivilege 4692 taskmgr.exe - Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe - Suspicious use of SendNotifyMessage 36 IoCs
pid Process 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe 4692 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4016 wrote to memory of 3736 4016 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\OP-5\libcef.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\OP-5\libcef.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3736
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4692