Analysis
- max time kernel
149s - max time network
112s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/05/2026, 22:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
B612.exe
Resource
win10v2004-20260130-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
B612.exe
Resource
win11-20260130-en
2 signatures
150 seconds
General
- Target B612.exe
- Size 18.5MB
- Sample260508-11rv5aez21
- SHA256 01b9607028ea83bf227cad4aa440b4ffcd4740ee2fa156c4c3e1489af31c110c
- MD5 fa17ff72227c3f2f91d94dd5a0556db4
- SHA1 f8ddbc25b1e2d16a50edc0a72c9109f8edd32018
- SHA512 93605a8ae0194cd62912245f2f3daf2cc1ab52ba135c387fb55222350ff051281608bcaf2993cfa24ed0c31c7fd91642d2bf740a3edbc35bc6f4f12e773114b8
- SSDEEP 393216:Mzg8RTVKmYgysnH5JZoaHwtkqebNHRLk6D3FTiuUgogVprghq:l8RpCyHQtkqebNbBiu1tMq
- TLSH T12C172353AAE14065D9F10074D8FD8A62296D7E3CDB62C7D391C01FBA3A231C39B792E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 7 IoCs
pid Process 4320 B612.exe 4320 B612.exe 4320 B612.exe 4320 B612.exe 4320 B612.exe 4320 B612.exe 4320 B612.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B612.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\c777c391-2b41-42f3-a951-b6cc7663559d.FusionApp\Box2DBase.mfx
- Size 281KB
- SHA256 97dd5ef947e37b51b65e109d3c271fd11d1d31d17ac4a6ac84ec3f4566c2ba7c
- MD5 b1cc9da686ba824713d027f40ecf21dc
- SHA1 f8e11aa01e2fd0a2c1dcefbc5e2f0e3b7dcf9498
- SHA512 af970882c308385caa0c844decd03d479549cd1d2adda36772c6c39130c56947e663ebe402df148d2c07438f4658373a604a6e682197e31916e46f62f9aa3ecd
- SSDEEP 6144:23Hyu+yR3JQ5vqrs5+WK3SjNubJa11F6ZoalgbFOpN:23SujQZjEaDF6Ryb
- TLSH T167544940B0B1C1B2E56D2934B968716B7D7E3D650B38C4DBA3D4046DCEB46C19AF2BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\c777c391-2b41-42f3-a951-b6cc7663559d.FusionApp\Box2DPlatform.mvx
- Size 120KB
- SHA256 baddb191565841457ba551d6f618d8ae94ea60ed4b3aaf8fdebc38a69137893c
- MD5 1fa9f2111ad98a382273af6bde386f3f
- SHA1 0edcb8371d881ad1abaa2babdce50cacfa7347b6
- SHA512 f34f0fc6170912d3714adc75211ec7cca7b50580d60eca0a5e65dc5f7403ae6f8068513924c67af81085cfd776ad76974e402a10fd9ce6ddec31f010d9d209ea
- SSDEEP 1536:5guqSFejeChWmZjIGEaOk3WDOLWZFT1YBsLCELhPCd3XsWHTXcdqN3aiO7a1bc5:5LL4jDhdEaRWDOLWZB7PqRmqN3g735
- TLSH T1EBC35A00B6D1C0B2E1BE1E3918759A625B6E7C21DFB89DDB278416AD4E742C09E31F37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\c777c391-2b41-42f3-a951-b6cc7663559d.FusionApp\mmf2d3d9.dll
- Size 1.1MB
- SHA256 3cde7a9181ab63a42cd3535d279d0ab1397b7b78fa3ddddef832757ab2024101
- MD5 72bb9180f8905c0da95566b778cdac5e
- SHA1 e96145e8120514092b35f67f1f120b958997f921
- SHA512 c2c8d8c74c53a78545e69f27a7fe1a6d1291888158962e93e16e6ec9950f86e74c68bd2eb50d04db0bff58e8dc93455aa384245991c5afe34abee36fef53710f
- SSDEEP 24576:EE6cfv6jilsTCw8RCmttZtcJPFGySBDmXA4HwLSJcl:CyA8omXGSFmdkl
- TLSH T14135BE51F292C036C0AB23710657A3B932BDAF251D7585CB1A88BDBA3F345E147293DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\c777c391-2b41-42f3-a951-b6cc7663559d.FusionApp\mmfs2.dll
- Size 501KB
- SHA256 bd234d4d552df49d6b9ce6aa0bc0c3b67742c3192c697f1cc8956ae4d512ce0a
- MD5 23fda90f588b76bd9660fdec4067172c
- SHA1 2778fcddd56aa10bf936cc2ab757de9031c0e9ab
- SHA512 9a4a7eb8a1e5cf6057e3b13753217c16ce78a0196b1011259e6e27c9c7a6de26cee72cff8c936d7da61a54608059a91af429c4cfdc419faaa37d63fdc80e3bff
- SSDEEP 12288:dl2w5SNFe2TMNMfeZJyxqNEQ8W7zf+IL2SUoOHxwVoipcVDNLTrgLiqs:OdNFe2TMNMG4qNEQ8W7zGWYd1DLTEWX
- TLSH T19CB49E10B982C231E4EA11B28AFDBFAE152C677147B858D75B485DBD1D300E32F3266B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\c777c391-2b41-42f3-a951-b6cc7663559d.FusionApp\mp3flt.sft
- Size 24KB
- SHA256 ddeafda7b28bf7545e3ba164aa4a74219eb961c36bb974e0f5085a07daf18f44
- MD5 dadc138be9d36e6e4b8e4bf9ef2de4bc
- SHA1 2758db786c544ec7889f26edf9bc4634c9240af0
- SHA512 63a21c5eda225c7fb8a67595c3180d4fdc1bc37d3b45f839e1b562ef946bf5b2237a9ff17c3f6f5de489779bbb9652ac2a1a74b83f153883bd436756acf249e1
- SSDEEP 96:YDe4ApKjaU5qIu9my5F3hM+EX0025ZpMx07/nYwHZLoDK585qQ+5l:YDhAc2uXw32rX0ffMxdINoD5zEl
- TLSH T1E3B21A22B7A50CF6E1564E317DDB0377A57AFF9457A462479E82C23D0C33A02981B673
- MD5 SHA1 SHA512 SSDEEP TLSH