Analysis
- max time kernel
151s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 09:10
General
- Target Solo Leveling MMO Idle/Solo Leveling MMO Idle.exe
- Size 108.5MB
- Sample261102-k41dnsssey
- SHA256 43a9f2c6f2b7d642d7a0e42815a0cf22f26c32a7ca01b278965b51ec9456bbc7
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Solo Leveling MMO Idle\Solo Leveling MMO Idle.exe"C:\Users\Admin\AppData\Local\Temp\Solo Leveling MMO Idle\Solo Leveling MMO Idle.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$exe = 'C:\Users\Admin\AppData\Local\Temp\Solo Leveling MMO Idle\Solo Leveling MMO Idle.exe'; $sh = New-Object -ComObject WScript.Shell; foreach ($d in @([Environment]::GetFolderPath('Desktop'), [Environment]::GetFolderPath('Programs'))) { if (-not $d) { continue }; New-Item -ItemType Directory -Force $d | Out-Null; $p = Join-Path $d 'Solo Leveling MMO Idle.lnk'; if (Test-Path $p) { $alvo = $sh.CreateShortcut($p).TargetPath; if ($alvo -and $alvo -ne $exe -and (Test-Path $alvo)) { continue } }; $l = $sh.CreateShortcut($p); $l.TargetPath = $exe; $l.WorkingDirectory = Split-Path $exe; $l.IconLocation = $exe + ',0'; $l.Description = 'Solo Leveling MMO Idle'; $l.Save() }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
030c88470e4fb3d96a7974b8c9faebfc11c19f41c508f360baa3dc3e1b262395.part
0fc1000e6df5621ad77ce58330ee0fb2e5c5ccb551f3c37e9d73c30057dfad13.part
112c2d5b31b3d96f8d19cfd48ef5866ffe866b2f47c40101a4c5fadc6e117088.part
22a6a0e5305f9c4be7bfb8e34875bad91f841c0ea85087d81128987235a712c5.part
3027f23ca5a46dd9cb8183fbd522983a86f64d7daac5982912bf9f214671f294.part
378de015487f9fea6c0749570c415b1aa11d73c706b248a70736247ed4cfb24a.part
3a300de77180e0610b891a593933e4632c404642ae90b8b297ac1669d240bcc1.part
3c478e4cbed877cdb72588d8b9a30bf74ab57413dce5e97318ed31ddac545f95.part
3e075901d2aecb1a9afdad870dffcf1c67e715b81270161a9413dccbdc4cb753.part
41c0ff16a3e0db9437e9ea4a9f07e8e82dece120f2a0ae3ae3fc055c9ff0cbe5.part
4296a67e182aa22e454e2db8906ab30c1667753a8d245b93a88010856f48ecd0.part
437177aaa48863180e856fba8770e34afefdc0135c301454e8a46c964dff563c.part
43984e91d7a9c477d25b09975eca774ccd481468aaf4a4dfcfd87d1011dfdc9f.part
43a9f2c6f2b7d642d7a0e42815a0cf22f26c32a7ca01b278965b51ec9456bbc7.part.gz
4685bc9023d6baa6448d66b3daa21f545f21ce2e1a61d52e710e067bdbdd42ee.part
4d5dbbb38b1a2cb47db6571e656771c3492d5d20d7c87ab882580eaa8463969b.part
4db63698a2a4f585587574c421e08753c64f9a9a95963a3aa31f9252c194eb27.part
53a695527c55f49e33b8a544d69f3f362d7c5d2387b1f5a6dbdc138e0046a6f4.part
5e89e6f266f0fc8fa257ac4098cea66c09327ee1111e6d69acecc41d44e92708.part
6bef79b49ffeaf7b3868fffb5689c581e596a7b67fc3ab28c9faf89776465c26.part
6cc57ff6c6f3988be9f31faf28231a898ecf976fe0396918843268c9733498f1.part.gz
7ae0e6e39627ac9b380ba668fde8839d156ddf1bfee8bf60596f3b1e910d259e.part
7d360bde738b48c9277bb3650b52eec2b84618c8aecac2422c95ae6ca183e032.part
888cc1c42e45c3e35d0ab2be1204469d05116581a51103f7cf3e3f894a362cb7.part
8ad96910701b8f1a3ba5ba130f31d2304a1ec95da079cbf7c246b5c4cb7ec268.part
8adc23435f192265b22e855f59fb148c31b3b763e44d913a2e1d4551da706165.part
8c4ba9b7a8a70324e085d68dc25734397b6a091f732a76c6cf131c48ea6ae03e.part
90432cc2f37b77a48b9c0c1643927f35afaf7f4e81e677317053f976bd49adc2.part
927e0f6a512c8eb17f1ecb66c2ba6fb1be475f75e6d252eca384b411d1377721.part
a4ed24effcd4fdf917608d750ac9c7d97d629bab5bc20ec0654e2a3266851b08.part
a6fdec7e5b998020d0942eeadef4e13bb4f7d2d8479520bd877602058ee09937.part
aea83292a80bef2dc874e31b51aa43d9d287fb185b7e25cd3174f1d5c76a080a.part
af16068fd2f818b30df11b5ea78891778fd7259f20399f111145d9108524cd6e.part
b0435e3b3e4e55238f05f4b306f30524a1b2e20147810d436eaa554fa6855c80.part
b099efdca6b12856452d9ffb93cf3783be706815fa2e0a866bcce0d892b5629c.part
b17e89f623097198cc106907cbe569188dc62eda931ac739acffe9e3c2f7f190.part.gz
b2657e051085bc559da94957c17893c43ac838c0a1105b48b6c476ebde9a7ed6.part
b5b3d64d86dae48ea7f6b93b97e50017a5245b48c6cd7999d49ffa8c024f6b87.part
bd468cee5ccd64d25ae31c332aa5dbde4f327603fac3af05b6f6ee8e3e2df689.part
bfa6ae6262cc6ec9c9bf1345f8f3cee64ad91615ca69a6ce054a6ec68b5c7bd6.part
c188119fdac952c215ad7cd6cfcc190de178cd67f94ca1d3187a691b26d36b90.part
cb20eb54396e661e53130350633b7911daeb29a7c597f1935d1726986f16c8cf.part
d04f8abf109a579d0880d7e7190aa181f59afe3779d17815ae428e638b3babd0.part
d9ffa72aa48547ee7d0dd4292a1d8547dab47ed4342975d23bf0dd2bdd89ea35.part
de5bfcd9852720a9e26f308d194efbb0d888ca7be201bb8e30db2479972de817.part
e242045164c654f16aa48a99e9cf706fb9eb6000d859500faa08bb9580cd8e47.part
e8ee81b78b676c82982c52adce0d9de17a2007eb4c45c48b4fd68a08f5729cc5.part
ea29994503b96310d10ae8f838a5544616ce4c718966035cf9c7034ffb19f7c6.part
eb3c82f470d8fbc4cd02fd128d7a03f3afb0ce48a743b8fbedaf17eabee3bcfb.part
eb76dbb8b9046e196cd1eb4b7d95ed2791c275382636abb78a75a1e0944a994a.part
ed95fd404632d36905d64d936084435f8b57147d1eec2b6b3dd7567fd9815ca7.part
ee0971e747ee44d2e3e88146cc2008bdfd268cfe21cf517d86f1b1ca3e366467.part
ef2696b06073690d1458daa45f2966c9b11e51cf7919a5507e1d093c88bad88f.part
efa3c86e3af96d616cd82d8c65272e6a863490c24a49767b925488f6f355abd7.part
f677f6563f7c7ec8216362a871fbb4e554e2b9ee54009e74e994f72d141376e5.part
fdd92f2d8e091838f2051e85a350cd70948b8457bba6c7562da4cfe11a92f290.part
lancador.log
memory/2356-35-0x000001F1F9EB0000-0x000001F1F9ED2000-memory.dmp
memory/5196-50-0x00007FF658ED0000-0x00007FF659ED0000-memory.dmp