64dfd5b1026700e0a0a324964749da9adc69ae5e51e899bf16ff47d6fd0e9a5e

Analysis

max time kernel
149s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
data/flutter_assets/assets/certs/cacert.pem
Size 222KB
Sample260503-exmlcabv9t
SHA256 64dfd5b1026700e0a0a324964749da9adc69ae5e51e899bf16ff47d6fd0e9a5e
MD5 f586a2260272a64e67aef3526353dcd4
SHA1 b4d7062cd418a22d31b8fd7a5ee1dc984750c51a
SHA512 f9d72ca604f238f86d3b0233b4bd20cd728529f74eb190ad7a37f942b00b014a717fa771c848233365938ca090e7e855ac2c3abdd4a25e18ce16b99b65ef56c3
SSDEEP 3072:yHetHRqCCZjlkKSNY5h61W2BzEY2S1S4dmGf3IcCJjEWh3c+dogltO/ZyOTi1Pjx:OqU9NgI6FdZL52dTOgwQh1hV1AP2u2Ft
TLSH
T1C124AEEACF953C4A28E3E094C9AB037ED919C3629DDAB0B31D593805D78972D61FD08D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1344	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\assets\certs\cacert.pem
1⤵
- Modifies registry class
PID:8

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-0-0x0000014EA0FB0000-0x0000014EA114A000-memory.dmp

Download

memory/1344-1-0x000001DECC4B0000-0x000001DECC64A000-memory.dmp