8131939c30ae966ba2a0ce125f709fa74404eb5dd8b04bfcfcfa9d2b4c894830

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader/devkit.dll
Size 7.7MB
Sample261102-e7313sey81
SHA256 8131939c30ae966ba2a0ce125f709fa74404eb5dd8b04bfcfcfa9d2b4c894830
MD5 dda18442f52cd3209621d9450769a6fb
SHA1 58168ebb0c87c901b7fc98491a120437f57407af
SHA512 1f54cd95840fd73b2dbcdbbc4f2b744c245ef5fd1591d6356930ca0ae2ac208eeb0635fea6be5cdc9d2bfe3be0ad7bcdd9c845a60d0e3b76aff779f39e48fc79
SSDEEP 196608:358JNiMctnzds0BwdWSEvl6GIXb+Cuzjve4Sxn/IpStxF25+:JHzIXCenp/lb
TLSH
T1AB86129E2DCB40F7D9C114B0D71B6BE713F6A5E00B864CF72AC5288561A2EF6703A587
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 4800	556	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Loader\devkit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Loader\devkit.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4800-0-0x0000000074200000-0x00000000749BE000-memory.dmp

Download