Analysis

  • max time kernel
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/11/2026, 22:01

General

  • Target
    OpenUtau-win-x64.exe
  • Size 163.9MB
  • Sample261104-1w72jsf12m
  • SHA256 bac4f7dd5857b8bc722e85909f539d9230d2d1d1bb749a6ac776008cc44cc616
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 39 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OpenUtau-win-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\OpenUtau-win-x64.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3240
    • C:\Program Files\OpenUtau\OpenUtau.exe
      "C:\Program Files\OpenUtau\OpenUtau.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1964

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Avalonia.Controls.dll

        • Path C:\Program Files\OpenUtau\Avalonia.Controls.dll
        • Size 3.3MB
        • SHA256 140192ace9edeeb219be5903f12611ba87ffbd3577c342e3febf1c52f9540150
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DynamicData.dll

        • Path C:\Program Files\OpenUtau\DynamicData.dll
        • Size 2.5MB
        • SHA256 808b06d3108f825aa2f4e821f6a02e75a7dc26f4310c06cb68e72ecd20011c40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Win32.Primitives.dll

        • Path C:\Program Files\OpenUtau\Microsoft.Win32.Primitives.dll
        • Size 15KB
        • SHA256 56b957b1db34e280cfdbaa9097776934286c79f8c1e07ba3449c3dca75862325
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OpenUtau.Core.dll

        • Path C:\Program Files\OpenUtau\OpenUtau.Core.dll
        • Size 32.0MB
        • SHA256 98e3b00dbdc9e952e1ade34feee4dee76491c9576762264c9edb5eb1a39123de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OpenUtau.deps.json

        • Path C:\Program Files\OpenUtau\OpenUtau.deps.json
        • Size 91KB
        • SHA256 29c486950fb807b07c1006090f359c62b0fb32653110acf8a258589c6b707bfa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OpenUtau.dll

        • Path C:\Program Files\OpenUtau\OpenUtau.dll
        • Size 7.5MB
        • SHA256 0712391eebcdac4c065c6ac3e156ad8982d5a458a45547c5f1b846394e089f0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OpenUtau.exe

        • Path C:\Program Files\OpenUtau\OpenUtau.exe
        • Size 276KB
        • SHA256 410674fd727bc621a228fb704d161e778e7f9e019b0fff0029007b28082ad3f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OpenUtau.runtimeconfig.json

        • Path C:\Program Files\OpenUtau\OpenUtau.runtimeconfig.json
        • Size 529B
        • SHA256 bff8e794f100e25611d9f3d1cdf7875bf3a4e840908ea539a7284fffe9c22bea
        • MD5 SHA1 SHA512 TLSH

        Serilog.Sinks.Debug.dll

        • Path C:\Program Files\OpenUtau\Serilog.Sinks.Debug.dll
        • Size 20KB
        • SHA256 f64f37362524ebcc8a103daf51bb66ffe6db42c825adce85abcf902ff18a795c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Serilog.Sinks.File.dll

        • Path C:\Program Files\OpenUtau\Serilog.Sinks.File.dll
        • Size 72KB
        • SHA256 99438c39ae2ff2441b5d12cfd1bac5284c05a37cef43b81525844bf5f93ff18a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Serilog.dll

        • Path C:\Program Files\OpenUtau\Serilog.dll
        • Size 400KB
        • SHA256 50c8781eaaf9679495a5b58b2abc7805b906cae348a5506d013633279ff4437b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.NonGeneric.dll

        • Path C:\Program Files\OpenUtau\System.Collections.NonGeneric.dll
        • Size 101KB
        • SHA256 a13e2d330938c175d92bf7ef09a39c669c3dff4629319b4366ca71a52ed0dc8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Collections.dll

        • Path C:\Program Files\OpenUtau\System.Collections.dll
        • Size 289KB
        • SHA256 ccf9ec3d536d6241c54a874833bf7d2329b9ecc5b8d4298c27af271f0e91b223
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ComponentModel.Primitives.dll

        • Path C:\Program Files\OpenUtau\System.ComponentModel.Primitives.dll
        • Size 77KB
        • SHA256 079cf4a6a2c9ec77b9e03f0222740f9eaf9f5e7359a16fbf3450ad7bc44de321
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.DiagnosticSource.dll

        • Path C:\Program Files\OpenUtau\System.Diagnostics.DiagnosticSource.dll
        • Size 489KB
        • SHA256 00fcb56efba898ec0ddbba14cd7e618486c0e5b09467995d4205bda24184fb9e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.Process.dll

        • Path C:\Program Files\OpenUtau\System.Diagnostics.Process.dll
        • Size 321KB
        • SHA256 0a616a3b22f0ec2e8c1ccf6e42ff6acc6f91dbd2cfa5274f0b230d04f1363d5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Linq.dll

        • Path C:\Program Files\OpenUtau\System.Linq.dll
        • Size 681KB
        • SHA256 079e0935f903f9e2076225d7bad46518c5b47ac5c0def9643273575d0062f2bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Memory.dll

        • Path C:\Program Files\OpenUtau\System.Memory.dll
        • Size 157KB
        • SHA256 5316822e28d6269071aa58e752c8b12f242b2abed0bbc0d0d2e63af6935fcd87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ObjectModel.dll

        • Path C:\Program Files\OpenUtau\System.ObjectModel.dll
        • Size 77KB
        • SHA256 99c6aa46d55e7387aa666d875a1f7137afff2d61d0cb5d8e58e4ebb2223849bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Private.CoreLib.dll

        • Path C:\Program Files\OpenUtau\System.Private.CoreLib.dll
        • Size 15.3MB
        • SHA256 0a175cdd09067c52f8b2477cfcebf894b2f926d7302e55ae76fc921529662c7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Private.Uri.dll

        • Path C:\Program Files\OpenUtau\System.Private.Uri.dll
        • Size 249KB
        • SHA256 de8a09a693727e8b326103bca2f6b3dd70e13a0ca0ef954aa2d9e060ec4952e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Reflection.Emit.ILGeneration.dll

        • Path C:\Program Files\OpenUtau\System.Reflection.Emit.ILGeneration.dll
        • Size 15KB
        • SHA256 43d006580a2a67f00d608e09685c25b93b471f6adafe925eeb0662e5449bb3ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Reflection.Emit.Lightweight.dll

        • Path C:\Program Files\OpenUtau\System.Reflection.Emit.Lightweight.dll
        • Size 15KB
        • SHA256 9f3116a7e4bdcc0ef134da1699eb03458802dd22bbe79a15c3095e2658b30c27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Reflection.Primitives.dll

        • Path C:\Program Files\OpenUtau\System.Reflection.Primitives.dll
        • Size 15KB
        • SHA256 dc7c8ce0276371cc4b8ffd7b819a43aa45ae7d624a113af2c68c430980fa1ba4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Runtime.InteropServices.dll

        • Path C:\Program Files\OpenUtau\System.Runtime.InteropServices.dll
        • Size 109KB
        • SHA256 664d77cc2163f40e80ac0e1ee4ed84b3a5c21c580a277dd63fdd4e448e55a3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Runtime.dll

        • Path C:\Program Files\OpenUtau\System.Runtime.dll
        • Size 43KB
        • SHA256 dc17d00429e6c256e6eeb0140fa9294d819fb6e13c24542fb01c2c3b424dff63
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Text.Encoding.CodePages.dll

        • Path C:\Program Files\OpenUtau\System.Text.Encoding.CodePages.dll
        • Size 841KB
        • SHA256 fef946f87f73715f86eb3096cc642252425d791c21cf4f3b8f1cfa6e8b0d6d1a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Text.Json.dll

        • Path C:\Program Files\OpenUtau\System.Text.Json.dll
        • Size 1.8MB
        • SHA256 9f4fd55056a3ccd6aa5f204933f9b8e3da412b060238cbeb8bb2be2fe4046f2a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Text.RegularExpressions.dll

        • Path C:\Program Files\OpenUtau\System.Text.RegularExpressions.dll
        • Size 1009KB
        • SHA256 320fd9a1cc67028d9e736661764680be4c8fedc4157395a02b4ec02765de0e5b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Threading.dll

        • Path C:\Program Files\OpenUtau\System.Threading.dll
        • Size 81KB
        • SHA256 3bb4d100413ff281ea8a70a22216d8d17d4bcb21610be258d948de4ce6b1a8e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        clrjit.dll

        • Path C:\Program Files\OpenUtau\clrjit.dll
        • Size 2.0MB
        • SHA256 2a2332c3c0cb023e71deb356b5fb85ce9045fb8434734dcfe9a7529e427dc858
        • MD5 SHA1 SHA512 SSDEEP TLSH

        coreclr.dll

        • Path C:\Program Files\OpenUtau\coreclr.dll
        • Size 4.4MB
        • SHA256 18eed8c40d05fc455be95d12cc77eacf379265063b15ca84bd7a11cf29078a22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hostfxr.dll

        • Path C:\Program Files\OpenUtau\hostfxr.dll
        • Size 370KB
        • SHA256 2e6bf792d54303a54467102fd873a7d7a993f828e8d19c040e13e428e5f2d9c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hostpolicy.dll

        • Path C:\Program Files\OpenUtau\hostpolicy.dll
        • Size 369KB
        • SHA256 90f9826f48e6416902199dee0fa1954536fe4c5191f5fd44b1bc6de623eb99c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LangDLL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsf6818.tmp\LangDLL.dll
        • Size 5KB
        • SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsf6818.tmp\System.dll
        • Size 12KB
        • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        modern-wizard.bmp

        • Path C:\Users\Admin\AppData\Local\Temp\nsf6818.tmp\modern-wizard.bmp
        • Size 25KB
        • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsDialogs.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsf6818.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
        • MD5 SHA1 SHA512 SSDEEP TLSH