Analysis
- user interaction
yes - max time kernel
149s - max time network
145s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
16/04/2026, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FishBot-v2.0.1.zip
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
FishBot-v2.0.1/FishBot.dll
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
FishBot-v2.0.1/Injector.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
2 signatures
150 seconds
General
- Target FishBot-v2.0.1.zip
- Size 24KB
- Sample260416-2casdacs2k
- SHA256 cab9fc74feadd220cba20f00928fb967c2dc47c849cff4d4464a3f557dd5132d
- MD5 e0164ceeee79c326b7dc3f80183a19d4
- SHA1 53f3bdef3607b38b5a97a34c21022a3cc36b735a
- SHA512 94cd5681a00309875956909c7c5850a1e4d57c998511c7c85d0e282d556b95b6e6cf7357f9dde068cbe9825e437ce95558d0e3e4512d1aba2eed1fc0b2be662e
- SSDEEP 384:O8zV+q5QdD1jK1eWQ3BkKIruB/GPO23frtuypQrUlSGkGlTvhrrb:O8zMvdD1e1Z+c3fprarwkwhb
- TLSH T166B2E1B459B30AD2E96BE27C3251C311899448CF895FAED43DA558320A7178FF8C8C3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Injector.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Injector.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5004 Injector.exe 5004 Injector.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1324 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1324 taskmgr.exe Token: SeSystemProfilePrivilege 1324 taskmgr.exe Token: SeCreateGlobalPrivilege 1324 taskmgr.exe Token: 33 1324 taskmgr.exe Token: SeIncBasePriorityPrivilege 1324 taskmgr.exe - Suspicious use of FindShellTrayWindow 60 IoCs
pid Process 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe - Suspicious use of SendNotifyMessage 60 IoCs
pid Process 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe 1324 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\FishBot-v2.0.1.zip1⤵PID:4536
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:6032
-
C:\Users\Admin\Desktop\FishBot-v2.0.1\Injector.exe"C:\Users\Admin\Desktop\FishBot-v2.0.1\Injector.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5004
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1324
-
C:\Users\Admin\Desktop\FishBot-v2.0.1\Injector.exe"C:\Users\Admin\Desktop\FishBot-v2.0.1\Injector.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3864