Overview
overview
5Static
static
3DistroClient.exe
windows10-2004-x64
3DistroClient.exe
windows11-ltsc_2024-x64
3RegistryGrip.vbs
windows10-2004-x64
5RegistryGrip.vbs
windows11-ltsc_2024-x64
5clsTCP.vbs
windows10-2004-x64
5clsTCP.vbs
windows11-ltsc_2024-x64
5frmMain.vbs
windows10-2004-x64
5frmMain.vbs
windows11-ltsc_2024-x64
5modDatabase.vbs
windows10-2004-x64
5modDatabase.vbs
windows11-ltsc_2024-x64
5modGlobal.vbs
windows10-2004-x64
5modGlobal.vbs
windows11-ltsc_2024-x64
5modWIN32API.vbs
windows10-2004-x64
5modWIN32API.vbs
windows11-ltsc_2024-x64
5Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 09:48
Static task
static1
Behavioral task
behavioral1
Sample
DistroClient.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
DistroClient.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
RegistryGrip.vbs
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
RegistryGrip.vbs
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
clsTCP.vbs
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
clsTCP.vbs
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
frmMain.vbs
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
frmMain.vbs
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
modDatabase.vbs
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
modDatabase.vbs
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
modGlobal.vbs
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
modGlobal.vbs
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
modWIN32API.vbs
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
modWIN32API.vbs
Resource
win11ltsc2024-20260911-en
General
- Target DistroClient.exe
- Size 88KB
- Sample261102-ls6a8avs3n
- SHA256 f24ab8ecc786414bf8c30226d1c4950e5147e224df61620406ea5fa2d8e0f12e
- MD5 e043b06629612662a6901a03ded0d3c0
- SHA1 e8138da5f2fd229f5e41820beee6d7766905a7c7
- SHA512 eadae0ee8093a68974f78164d0e37c5535dc41e02af47946e70626357eb030bb01d8677bb4f63d1e06851feff3af997104e6b2d0f781fa5793fe3fea776e1e1e
- SSDEEP 1536:eveDjseVFWu8/LlQ4+4CPqYjTsP/4W5rL4CC7yO7yk:emc6Wu8/LlXxYja4p7p7/
- TLSH T17B93FA23BFAC1111F26B5971197965728D237C352822ED0F6346EA4D1A71A83F9F132F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DistroClient.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4168 DistroClient.exe