541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 05:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Size 2.0MB
Sample261030-f7d8dsdc87
SHA256 541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee
MD5 bb14c2b3a93e0077ae3004db1272ee96
SHA1 285ccd5f65d7844c2f8d69849a4836b6c548ef43
SHA512 3e79ac8169beafa75431acde8cbde81c35b344b67751da222020d41ef3ec03776ce753829e313682863769f17c84632254c7fcf0962f63cf455c9dea16aa956a
SSDEEP 49152:IGnGfq8LGOr1HLS5ktPRQL7tky0l66mrKTexhIdRF5qcjltdEVfgPOkdGIJb:tGS4hHLS5k3QLytmeTexhIp53jJEdgPN
TLSH
T1FAA533514C20ABD2F45E6CB0A629BCDA09C32D33268725352D57F65AE7B7ED240D2F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000d00000001c509-17.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
4392	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
4392	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe

UPX packed file 32 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4392-0-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-4-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral2/memory/4392-5-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral2/memory/4392-7-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral2/memory/4392-6-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral2/memory/4392-8-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-9-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral2/files/0x000d00000001c509-17.dat	upx
behavioral2/memory/4392-20-0x0000000010000000-0x0000000010176000-memory.dmp	upx
behavioral2/memory/4392-22-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-27-0x0000000010000000-0x0000000010176000-memory.dmp	upx
behavioral2/memory/4392-16-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral2/memory/4392-14-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral2/memory/4392-31-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-32-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-33-0x0000000010000000-0x0000000010176000-memory.dmp	upx
behavioral2/memory/4392-34-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-35-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-37-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-38-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-40-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-42-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-44-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-46-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-48-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-50-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-52-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-54-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-56-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-58-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-60-0x0000000000400000-0x000000000073C000-memory.dmp	upx
behavioral2/memory/4392-62-0x0000000000400000-0x000000000073C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ProgID	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CLSID	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0\win32	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\ = "dm.dmsoft"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dm.dll"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\FLAGS\ = "0"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CurVer	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ = "dm.dmsoft"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\Version = "1.0"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ = "Idmsoft"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\ProgID\ = "dm.dmsoft"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\ = "{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\HELPDIR	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26037A0E-7CBD-4FFF-9C63-56F2D0770214}\InprocServer32\ThreadingModel = "Apartment"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\FLAGS	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dm.dll"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\ = "{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\TypeLib\Version = "1.0"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CLSID\ = "{26037A0E-7CBD-4FFF-9C63-56F2D0770214}"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dm.dmsoft\CurVer\ = "dm.dmsoft"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3F54BC2-D6D1-4A85-B943-16287ECEA64C}\ = "Idmsoft"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84288AAD-BA02-4EF2-85EC-3FAD4D11354D}\1.0\ = "Dm"	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4392	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
4392	541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe

C:\Users\Admin\AppData\Local\Temp\541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe
"C:\Users\Admin\AppData\Local\Temp\541ad70310300b1daf183a5130eaae56049e0adf0b32a7c89b67ce01382d7bee.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dm.dll

Path C:\Users\Admin\AppData\Local\Temp\dm.dll
Size 804KB
SHA256 3b6ddc32b800a18b21a819e842cbfdd57cb065fd92cc69545e0ef29b97cfd389
MD5 c578b6820bda5689940560147c6e5ffc
SHA1 922e50d89c9c44bdc205ef17aa57212b64e58852
SHA512 9f2a1bb5788ad245242d12968bbf198af2694a87c6e2342f14672e8c14e8489dd3319434592fc9b20f620557d0fa58482903d19c7f5ba32456a1e4076dc1bb85
SSDEEP 24576:3rhlxaCsVb6KoTpZCFg6DTk1F2RjkjCQG:VWCsVb6KUpZ+hDg1F2d6
TLSH
T1A8051263BB8AA932E03ED9344957335E1FF1E8211C41B7532B19662C5DB33D43BC19AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4392-33-0x0000000010000000-0x0000000010176000-memory.dmp

Download

memory/4392-35-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-5-0x0000000010000000-0x00000000100BE000-memory.dmp

Download

memory/4392-7-0x0000000010000000-0x00000000100BE000-memory.dmp

Download

memory/4392-6-0x0000000010000000-0x00000000100BE000-memory.dmp

Download

memory/4392-8-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-9-0x0000000010000000-0x00000000100BE000-memory.dmp

Download

memory/4392-1-0x000000000073B000-0x000000000073C000-memory.dmp

Download

memory/4392-34-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-22-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-27-0x0000000010000000-0x0000000010176000-memory.dmp

Download

memory/4392-16-0x0000000010000000-0x00000000100BE000-memory.dmp

Download

memory/4392-14-0x0000000010000000-0x00000000100BE000-memory.dmp

Download

memory/4392-31-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-4-0x0000000010000000-0x00000000100BE000-memory.dmp

Download

memory/4392-32-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-20-0x0000000010000000-0x0000000010176000-memory.dmp

Download

memory/4392-0-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-37-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-38-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-40-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-42-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-44-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-46-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-48-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-50-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-52-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-54-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-56-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-58-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-60-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/4392-62-0x0000000000400000-0x000000000073C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads