b9d975b61efe303eb5bcb7bb6f0bce6d704b3dc1531aafafc83e8b1b7c939cb8

Analysis

user interaction
yes
max time kernel
149s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/04/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Squad.ICU 战术小队全能助手v1.1.1.exe
Size 368.7MB
Sample260426-teaamaes2l
SHA256 b9d975b61efe303eb5bcb7bb6f0bce6d704b3dc1531aafafc83e8b1b7c939cb8
MD5 d1c405ae5b3d5f434ae81f64a510b3c4
SHA1 6354e750f93f3d4e4bfe400f8de6a7ed77b2314c
SHA512 21d87ef0305b049f2962219d8469f80577f3c6d1edbb6500fd0e4a090d17fd9988b64f602cc3287e0d6f8e425be57390b46baae2fb3b51fece29b552e1459f19
SSDEEP 6291456:CvOOQrcU6vWZSKlElcMJxhFmttycFhVdQ1jmIWIX9ZRp8bey1pvlfMPmwhQFJgMU:kme6SKlElx3hFeoiQ2IXpWBp9f+KK
TLSH
T1CC09338B4ED81812DA1BABB95DB90B0EA77CEC35590E661DF308700F2CDB8643D64BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4604	Squad.ICU 战术小队全能助手v1.1.1.exe
4604	Squad.ICU 战术小队全能助手v1.1.1.exe
4604	Squad.ICU 战术小队全能助手v1.1.1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Squad.ICU 战术小队全能助手v1.1.1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4604	Squad.ICU 战术小队全能助手v1.1.1.exe
4604	Squad.ICU 战术小队全能助手v1.1.1.exe

C:\Users\Admin\AppData\Local\Temp\Squad.ICU 战术小队全能助手v1.1.1.exe
"C:\Users\Admin\AppData\Local\Temp\Squad.ICU 战术小队全能助手v1.1.1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\FindProcDLL.dll
Size 7KB
SHA256 cffec7f0bbcfca2873c510d93666e0ebe95e236433c3c415358dffc50a70e44e
MD5 81a424cbfa89976b1c40da870d8ad4bb
SHA1 a43f1b04eb8726552eb8934b0db2e76c46535e35
SHA512 555d28e23fe7dc97400356ae6c1e13b1e1e18633a153fc7ddafe76a11ccae8d166a550dc0c61c03a9041f691ea74b2501c0f5ad20bb8390375ceb63128e1af5e
SSDEEP 96:PNrt9XBrYR9YVi4fl+l0tMh6VLuiXX8VASx3aPmh7z7GOVINv3vTx3mtJsBKz:Pv9XBrYR+jtyuLucgs+INv3vN34JGs
TLSH
T105F1B7435B011472C1F8943CB8DB45375BEDB23062B36787E92BA9263E991D07C7D7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\InstallOptions.dll
Size 15KB
SHA256 2a2845b8bc368a71f0973f30851c25f3ea70172bc5569792ff9222d12aa0d67d
MD5 68bb5139954c236860a25cde611dac33
SHA1 269755dff956cb5fe31dae6fa357a43fcf68928d
SHA512 93b5c263fcfa5ab8fcaff331ba5f22b39a2c3d3e01c820497660f88e150d80b663dcf925e5d867af1addae2b1a5732474c3533897a583b271597675c07e6309d
SSDEEP 384:0CNorf/mefeZBKJjIM9L5qu/b6o554+gmCUW:5oKefeBksMV5j/bTP3
TLSH
T110621A52BAC110F2DED2A67036E77F371FB2B51094D5880B97B33E475922261BE35362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nso40AF.tmp\ioSpecial.ini
Size 1KB
SHA256 e11af7d3fba33e1e3cc6c8bd29cb5c49437c0113a3637eacb29a8f501f61fcf2
MD5 2ebaef364a75033b209e7fef156e0174
SHA1 283811d2692c8db1103e129d27374e85f1437b97
SHA512 468d69b110f3fe752ae244612be37f1fe3f1b479d782f7f5ba5c5ed6e9c74cae66d2204e8a64841e135c9abdff05742238fe11b834ba00b9ba172867ea0156a5
TLSH
T1D81108133AF95A05E36AB64CEBB58035533AB45A989DC60E81C14A0F45E9B418523FFF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4604-84-0x0000000000650000-0x0000000000669000-memory.dmp

Download