fe03828a7005e8369b17e89da14237603362ed2f9bd1df16584890530084be13

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
luci-i18n-momo-zh-cn-26.100.27495~383dcd3.apk
Size 3KB
Sample260418-phy1yaht5y
SHA256 fe03828a7005e8369b17e89da14237603362ed2f9bd1df16584890530084be13
MD5 5ecddf991189d88e8fab6a42227aa6f7
SHA1 a6c20f7732164d19a87ad10b28ead2a822d87e1d
SHA512 d80cdf4a444b4cba2a0192c9a8aa7840d3cb79350d06f11acbd7680af3a1fc11f5ca045a4101ac9ed2f63b048d1906a1152930a3720368053046714f40510fcb
TLSH
T1A8616CD1247AAC3A158A3320669D5384CD68B00B8708FE1C28D78F17CA28D75F4A4F95
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2256	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\luci-i18n-momo-zh-cn-26.100.27495~383dcd3.apk
1⤵
- Modifies registry class
PID:912

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-0-0x000001C511B40000-0x000001C511CDA000-memory.dmp

Download

memory/2256-1-0x00000269CA730000-0x00000269CA7D3000-memory.dmp