1ab85f881e489226a716259c59fa35254b31f311b2c993a71ccde37f9b304411

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/05/2026, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RPMPlasmoVoice-forge-1.0.4 — копия.jar
Size 4.8MB
Sample260510-k264facv9z
SHA256 1ab85f881e489226a716259c59fa35254b31f311b2c993a71ccde37f9b304411
MD5 c57714e05fa44a2cc8a08fad74ef05ee
SHA1 04511b757f0133ef0a12569fb709672e313ff7c4
SHA512 eb2fee064c2d1e8542aec595ad4cceb06aa56d7ba482212a2efb525c788d272d8dfaebb283031244b1e8c01c3bc19991c8867d1de15dae567decb08d4163e891
SSDEEP 98304:P8fTyX7giBKPXv+CU9YBn/kBNC2hkaLpc+9qrLkteeW70kte/kBi+PM4:P8fTyrg8KP/XYNC4bmAgIeeWwIe8A+Pj
TLSH
T1433623FBEFA3A028C717823C09B1CA01F879D7BDE225962B0995254C2D65E91171FF4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
676	Process not Found

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\RPMPlasmoVoice-forge-1.0.4 — копия.jar"
1⤵
PID:3504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3136

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:2756

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:400

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FileCoAuth-2026-5-10.99.400.1.odl

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2026-5-10.99.400.1.odl
Size 706B
SHA256 b2b688d30456c92aeb3da8ffede69a71f8e63d7f638681ec91f7a8fdfd68518b
MD5 a855d8e26f26cd5b51baff3ead9ef239
SHA1 e39758f73f7dca39ff4e7cb387dc231ca8de13fc
SHA512 397bd14b5a9352455b65af933d613418f64a69e97f527688b0eaf4b7cf47e6c494e604c5690f817c2d317e548724369f47c99d054df4b5c20b548fa5cf7921bd
TLSH
T1D1012EDAFD5F84B6DE31013CD40EF26D1915A9623C4E24358AC507964A0F3D1120EE75
MD5 SHA1 SHA512 TLSH

Submit Download

memory/400-3-0x0000000001180000-0x0000000001292000-memory.dmp

Download

memory/4568-8-0x00000000015A0000-0x00000000016B2000-memory.dmp