0a155896834665462363169cbf092f71635e16e5b36f1f63076d1c68f04aadb0

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4stack.exe
Size 735KB
Sample260427-apsp6sdt4r
SHA256 0a155896834665462363169cbf092f71635e16e5b36f1f63076d1c68f04aadb0
MD5 1b1a1ba9efb27b22009c7b5ce4c5c89d
SHA1 a8704b89eae391d5ea3a8edd856118e34f33ac26
SHA512 efc5c2ddbb77d64f461a8067e8b4a8c9e0f9f43b356054e79832e8a150e2727ae935552169faea7540f335425dd5791e12d1c2bff7c408a86699ad837475b1e9
SSDEEP 12288:szEapA0ax5400EStwh6xNtvuMUfqgImFdJu2hLPTLB28MI4S+Xxv80e8NdLpg1:szRbaHjONxNtmRhrU8MI4S+Xxv80e8Nm
TLSH
T186F4230F92CA45F3FAF3FD34AC61A64B9FA6B8850006E19962305D4DFF312716C59A92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2708	INS8DF3.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\4stack\is850F90.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isDACD40.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is0F5EF3.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is567FC3.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is1B15B1.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is9DB9D7.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is9FFB46.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\UNINST0.000	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isCFD63E.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is98585C.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is437B23.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is39AF14.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is779362.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is86D30B.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isB89911.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is359771.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isAEFCF4.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is68E718.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isEAE94A.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is7A9266.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is9DCB44.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isD4AEAD.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isB8E618.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is540EBB.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is95479B.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is7E27F7.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isF8CCCE.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isD7CC7F.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is3BE34D.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isE9368C.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isEC6F45.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isAEF252.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is272EEF.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is8C6638.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is41DFA0.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is4219F3.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isF55CF4.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is4CE707.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is9BE6CF.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is22B468.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isCD62AD.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is84C4A2.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is2F778B.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isE8FECE.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isF4EB39.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is54E35D.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is9A5588.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\isDDC27D.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is71ACDE.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is52655A.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is058980.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is2ED97D.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is4FFC16.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is0AF810.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is1F715F.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is7AA17E.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is75A658.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is6C73A4.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\UNINST1.000	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is7F063F.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is2BF5DB.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is63E4AD.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is099728.tmp	INS8DF3.tmp
File created	C:\Program Files (x86)\4stack\is91F679.tmp	INS8DF3.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\isC6B99A.tmp	INS8DF3.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4stack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	INS8DF3.tmp

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.4o	INS8DF3.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.4o\ = "4ofile"	INS8DF3.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.4o\Content Type = "application/4stack"	INS8DF3.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\4ofile	INS8DF3.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\4ofile\DefaultIcon\ = "C:\\Windows\\SysWow64\\System32\\shell32.dll,21"	INS8DF3.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\4ofile\Shell\Open	INS8DF3.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\4ofile\Shell\Open\command\ = "C:\\Program Files (x86)\\4stack\\4stack.exe %1"	INS8DF3.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\4ofile\ = "4stackExecutable"	INS8DF3.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\4ofile\EditFlags = "0"	INS8DF3.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\4ofile\DefaultIcon	INS8DF3.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\4ofile\Shell	INS8DF3.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\4ofile\Shell\	INS8DF3.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\4ofile\Shell\Open\command	INS8DF3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2708	1808	4stack.exe	84

C:\Users\Admin\AppData\Local\Temp\4stack.exe
"C:\Users\Admin\AppData\Local\Temp\4stack.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\INS8DF3.tmp
  C:\Users\Admin\AppData\Local\Temp\INS8DF3.tmp /SE C:\Users\Admin\AppData\Local\Temp\4stack.exe 208792 222362
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4stack.exe

Path C:\Program Files (x86)\4stack\4stack.exe
Size 383KB
SHA256 0039e2f493259fce0ff150d2d593bc80200408badf1640b9310da5b21c0eaf86
MD5 94ba58594391ecb72c7cc91fc158fc54
SHA1 e05def962578172167c0905d7b738dc198f5d538
SHA512 9a44026dfacd051055f6ca2f5b3228f35d50f94809d3e631dc21fa3f14346935aaa1cb42ea7751c9f8e8dd59b8895199084b42d39ef22b4f25052ecf6672da6d
SSDEEP 6144:7EqlJ7SSrwzJ3MquRw4bD09REOYzxPIvOBYtdzd8WaPohzymXT9xy:7HPTOWPmtnBTq
TLSH
T12684A66166A84ABFF3A23CB901B7391960A4F71B5F8CBF836B69115F6F81011B071E53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INS8DF3.tmp

Path C:\Users\Admin\AppData\Local\Temp\INS8DF3.tmp
Size 320KB
SHA256 5d87dcc07064c3fc11bf6685146836ab4beb20a53a630e8154d211b9e04a9f71
MD5 b413d7241433be1f05de2e6b0c806694
SHA1 056013e16ec2d4b1bc8b2ecda4e81c288392bf1a
SHA512 b6a1645ae5eb4ab8bf1c45eae4453e223ccc4c34809a33a8703a1b88e08e6f668a44b8063c9afa9696a36a9779b11c1cba6cecdd74388d5271dee5f007dffea2
SSDEEP 6144:OViKEEoqmHvTSWG5tiDN+KJL6hv1gedQQjkgtBpI:aiKeTLxG5MejbpI
TLSH
T1F4646C23F6814432D06B1A389D1B5FA49A2AFD002F28D9DB26FACD7D5E356803D352D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1808-6-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1808-207-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2708-4-0x0000000000442000-0x0000000000443000-memory.dmp

Download

memory/2708-5-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2708-7-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2708-9-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2708-204-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2708-206-0x0000000000400000-0x0000000000456000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads