ad962d8853d91a75e66d5a979599d64a5f0236d6cb5f32b16ec62675911d5157

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/05/2026, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Yuiki FQOL.exe
Size 154.7MB
Sample260515-ytek4sft2t
SHA256 ad962d8853d91a75e66d5a979599d64a5f0236d6cb5f32b16ec62675911d5157
MD5 c37e98ca1eccb97dc6f6636be1718cb8
SHA1 1bb460b28d3b66a77e3463c70e36e7acf6e971d6
SHA512 848240627f92a78d5ec720e04a773228064f93e9699a95caa6283387675de033a20b4f4fea804d39f104d66e2b06b846e257a4339ff22f080a5adad8f5b8843b
SSDEEP 786432:DdjjROX892vY1FUV5OtsFntaRu/bSs5c4ZQp5m8cq80dpMr7yZ3:BjjRG8MvYUFJTSs24qp5VJS2J
TLSH
T15A788D1163E81A45E27B8678977382A1E6B1FC535711C1CF0094FA4A2F77BC2BA36376
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Yuiki FQOL.exe

Loads dropped DLL 3 IoCs

pid	Process
3864	Yuiki FQOL.exe
3864	Yuiki FQOL.exe
3864	Yuiki FQOL.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3864	Yuiki FQOL.exe

C:\Users\Admin\AppData\Local\Temp\Yuiki FQOL.exe
"C:\Users\Admin\AppData\Local\Temp\Yuiki FQOL.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Yuiki FQOL\CnIkUMwcN1Yo\D3DCompiler_47_cor3.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Yuiki FQOL\CnIkUMwcN1Yo\PresentationNative_cor3.dll
Size 1.2MB
SHA256 00b7947c843a7564a0b168ed46abfdb87f6aa6bac8ca1bb277760f872c82ff95
MD5 794a50b30d205bdee8527554890aa7bf
SHA1 bbbb200b935a420cffe4f2fef0f2f79bd6e6279d
SHA512 5b8c55c8b492299114ad7dd27e9bb45395e03d76149787735fdf04ad444bfefddf785f51907a9355fe8d4215511231aaabd1ef3269025da9654ae59606107363
SSDEEP 24576:Ml8W6eU6UPXhA+JYCqX4T3MJj7OQ1Niqdhvc7PgNfb4i7fokJMpw5i2k1/m6eg9b:MH6emPXrYCqX4T3Q1Niqzc74xb4izMpF
TLSH
T1DB453A22D2E642E4C47FC1B8C646972BFBB17409231C66DB47608B652F67FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Yuiki FQOL\CnIkUMwcN1Yo\wpfgfx_cor3.dll
Size 1.9MB
SHA256 07c3631d158122ac48110bf81b1f67aa80c6965c8996ac1dda534b2766970b83
MD5 891d037da66271ed9cbbd5e6a1fd6ea5
SHA1 b9f1dab4c16f52e0c94cfab8cca789b3623c98ea
SHA512 08ae2897c33dc761c9290342b27e64522d51d4e95f486cda0c2f0783e57e0c085bf83e7a35e437b0b5d912119273831a7ebf95542dce5992e9c3c595e5c7f030
SSDEEP 24576:+7vme1ahPZ9dNv2A8KBlnNUrb0AbDRV8mSu+vPzTy7nfPq44LwjlViIthU:Aa/HNv2ulnKBPRrP+jTy7fPqmVishU
TLSH
T102955B4AB6BC40EAD47AD23CDAD7961BF2717410276197CF23A0479D6F27BD00A7A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads