5031bc98e08029a0593319445f8f47416e34033207668bc19ea1f5b5908f331a

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MuMu_5.1.0_OPqPgSC.exe
Size 5.8MB
Sample260623-slphfsdx9j
SHA256 5031bc98e08029a0593319445f8f47416e34033207668bc19ea1f5b5908f331a
MD5 307973ff78fc4bbaf5ada2159b5c6377
SHA1 8f22ae9e938b8f6b905230a545f941b308fdea09
SHA512 5b193f6c20c31496b8955c053bc0bcbe4baf67285fff3c075bd86a4c464dc66a1c1d0d676278760a5f8c6a84c4d915d5d98320dda50508179a48195c37d9fdcd
SSDEEP 98304:wer6uFFkOuPe3cjOH6rgc+6X7ZmKdlhqap1ZcWDtIELv9VCOxeI+S0bIwrSwVNJ3:tr6uFFkOuPnOOv7ZHlLbjXLWjI+SvFCj
TLSH
T122562392D60173B5D41E5DFC122C87B6FD933CDE6D082C4A028EF2AAB1BD5612E849D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	nemu-downloader.exe

Executes dropped EXE 6 IoCs

pid	Process
1556	nemu-downloader.exe
4960	crashpad_handler.exe
1712	ColaBoxChecker.exe
2828	HyperVChecker.exe
5944	HyperVChecker.exe
1368	HyperVChecker.exe

Loads dropped DLL 5 IoCs

pid	Process
1556	nemu-downloader.exe
1556	nemu-downloader.exe
1556	nemu-downloader.exe
4960	crashpad_handler.exe
4960	crashpad_handler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nemu-downloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColaBoxChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MuMu_5.1.0_OPqPgSC.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1556	nemu-downloader.exe
1556	nemu-downloader.exe
1556	nemu-downloader.exe
1556	nemu-downloader.exe
1556	nemu-downloader.exe
1556	nemu-downloader.exe
1556	nemu-downloader.exe
1556	nemu-downloader.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5600 wrote to memory of 1556	5600	MuMu_5.1.0_OPqPgSC.exe	88
PID 1556 wrote to memory of 4960	1556	nemu-downloader.exe	89
PID 1556 wrote to memory of 1712	1556	nemu-downloader.exe	90
PID 1556 wrote to memory of 2828	1556	nemu-downloader.exe	93
PID 1556 wrote to memory of 5944	1556	nemu-downloader.exe	95
PID 1556 wrote to memory of 1368	1556	nemu-downloader.exe	97

C:\Users\Admin\AppData\Local\Temp\MuMu_5.1.0_OPqPgSC.exe
"C:\Users\Admin\AppData\Local\Temp\MuMu_5.1.0_OPqPgSC.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5600
- C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\nemu-downloader.exe
  C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\nemu-downloader.exe
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\crashpad_handler.exe
    C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --metrics-dir=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --url=https://sentry.netease.com:443/api/325/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=d7282c50f1b64296835edf7d19667322 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\6f3a6dfe-85b7-42f6-c466-89337550e359.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\6f3a6dfe-85b7-42f6-c466-89337550e359.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\6f3a6dfe-85b7-42f6-c466-89337550e359.run\__sentry-breadcrumb2 --initial-client-data=0x39c,0x3a0,0x3a4,0x378,0x3a8,0x74684800,0x74684818,0x74684828
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4960
- - C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\ColaBoxChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\ColaBoxChecker.exe" checker /baseboard
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:2828
- - C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:5944
- - C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:1368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ColaBoxChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\ColaBoxChecker.exe
Size 4.0MB
SHA256 65aa91ee18b46603a5543fdd398d6331a9f77eb8a16a6933f2fe576fc62d6941
MD5 a6d0d421e32946a34de15e4e397ec0b0
SHA1 bc15a70e4d1f9815cfe8d2532d447f0702bb18f0
SHA512 b7817f72fabbf2017d91d48765b2bba83f784d7e02107695f8a7584f8834a12b0a745688d3cbede795b14afe7de4007442f8c96fcc0059b2af309c1ea1493e43
SSDEEP 49152:1gP8dFBouKaau2VgFLTeJxx8IHqQOPclSWkar66Dv4TpN1KjH304dAHRvOA:WP8dFuudB0gFLQ2QOQ660TpN1eX3dC
TLSH
T1DB167D31370BC135FF8281B7456DABAB437C8A650B7340DB92D42BBAD9352E22B35D52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HyperVChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\HyperVChecker.exe
Size 118KB
SHA256 d545ed2dfc015f965d35dc4950fe773cb94103a685d3c25c4b44fcb466a85662
MD5 ba1dd89be69ee0e03af11d90785b5b00
SHA1 8d46e63b0b9635ebcf79ab46093832dc4936b800
SHA512 ca33b083b717c2cb1f40fe6eb96b52b71ede808c1d09c782d659aa7ab6034fa612326f17ad4db0b8ed9f1ae2e8633db54f89ea95536a856f338dfe3286e9d6f7
SSDEEP 3072:0wLn2WoLPivTkgxUJ8UrtmMx7bB5dSUo+WziN:Jn2WoLP++J8Upo+WM
TLSH
T193C37D57A3E434F9E17B9638C8910A49DB72B87207609FAF03A442961F637D25D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\MSVCP140.dll
Size 427KB
SHA256 8acd9e63a83f2facfc68b801f864f923eac5fb8c8a046a32fef8d622ba7d407f
MD5 77e799e61066dfb983babee530e22fd1
SHA1 659484995b44b5d6e7d22d52abbfa2f68e27d32e
SHA512 e942da491509ce781abc2ea099fea110df076d264053b92a836428fcae82e29e07351f6678aa884ec26dd12230c864d3bfbd1058ecc94c89baa0cd5dd1826744
SSDEEP 12288:+LxU+0XySH2CyKSPRBb22umby6hUgiW6QR7t5s03Ooc8dHkC2eskI4j:wxUwSH2CyKaBb22umb203Ooc8dHkC2e7
TLSH
T121943932BB460DF1E48913B971C9472193FAFC610362E3C397DAF1262F566C6A633A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\VCRUNTIME140.dll
Size 75KB
SHA256 526d8774c67248aa62a5911acd7db667cc4bed5be2cd5dc139c6c4d5dfb9d57e
MD5 dff7397268e74ff615529032a9af2ccb
SHA1 68a671e4634825684494e45d7724a64b5146b3eb
SHA512 c0928d3c0e997bcc082530ff565569267f9e307f45f796a0f62c76f66c6121674d87123af19993f2b9f40dd7f059d1ded51c29d5d11b8dc47802cc83690e6d0f
SSDEEP 1536:c6H1qvERANBw6qntn64lqVwhNDyUZXRqtnHEecbCBg6yzT:c6HMMRANK6qtnsVON7JYkecbCBQ
TLSH
T1FE739E5274C48272C5AE4AB9017AF612663DAA604FD15FDB7FD8598C9B79BC0EF30203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baseboard

Path C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\baseboard
Size 114B
SHA256 e92da380f6a1a8e73cf064860b66f469f2492cffe8624a467a6cf10a7a7c2d3f
MD5 6fcd8c0c5ce3990bf822055caa6b201f
SHA1 99740d7c878fc9a28f7983e73334fbccdedcc2ee
SHA512 4d7ebbb3c31485a11e26dce1b3a9f2da7036c6db629b41fa93a188611b713c05275f1505edb91938eb81238448b284e7e3960cb31def1ec87eefbbcfe41a76fd
TLSH
T15CB01238D0C32C03C01B5505003E46E635405C738B066C703749097C5B4C46A2FE79CC
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\config.ini
Size 346B
SHA256 d2de6d14503fee031f5452a5b30ba67b1a5b82897c274450fb93ada5c7698c0e
MD5 d8a1b3836de9450944d1049ac3368beb
SHA1 5fcd1a8f52085b306a15d3fc30851877537f5193
SHA512 b5d382014e9e4e5c4bf6cbf9f3a9b58b40adfa89deec6dafbe6f2ee9b19c434d31bb44da85a3d2c5d4c37eb9f54c2156f1f7570fbc2cb04551fc874b02c5f4c4
TLSH
T11EE0127D16128917F6007FCD254B3301BD3AF1F37E408090EA68A5B6B933D66D22380B
MD5 SHA1 SHA512 TLSH

Submit Download

crashpad_handler.exe

Path C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\crashpad_handler.exe
Size 542KB
SHA256 9769c585019a1a19d96dc0f378bd90240015a54ba77288b2efc995f791a49bc0
MD5 9ba1e7d7bfce0e9e0d52f33ef5e01e91
SHA1 5e301c6d74602e30ecabd1e445dc334440b2e07c
SHA512 aeb4c76a23bf8664c140035491f3747a6a39b4f118dd12177e5b0aff021d33ff7a3903af22dc37cb350e582ca94dcdc6d64cb204c11f50b2caa7acf643dae00e
SSDEEP 12288:reAQnPupDjbkEW1b4uifVysTVRAtCX/BJ2LoUG3zi8SrcOTFJMjlgPrdhfbTh0aI:reAQn2ptXX5J6Gj/SrcOTFJMjlgPrdhW
TLSH
T12CC48D707A2AC136D25291F15C59EBF790AC991A4B7308C3B3C95B396A712D32F32937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nemu-downloader.exe

Path C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\nemu-downloader.exe
Size 3.5MB
SHA256 1a155769da623d402e66ef58216b943695f60bb60f3b753de0b3710145543f85
MD5 3c537170505cfb8876f907b1d26d0463
SHA1 53e03b7429bd1e6b903a0aa85e04e328d22fc1a6
SHA512 fd2627931ae3252280f2e83fdd3e4ac4a5d596d7b35b2396c0faa5abeab813816fba70fc866b7824e397470e5172490b9e8bbf76f8733e2f89c681366f6af646
SSDEEP 98304:o6jDk4I4kbMYYuaaICbnKVyP6Jpg/i25uI75h6uFFkOuPXn:o6jDk4mbM5966Jpg/i28u6uFFkOuPX
TLSH
T190F57C01B691913AF9F305BE89BD561F883D7E31071880C793C8595E2AB5DE27E31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sentry.dll

Path C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\sentry.dll
Size 223KB
SHA256 2e108ccbbd47997978512835013d06500bef5575f29cb937f623d30596662819
MD5 2c886b7927c0748042a5e294fba28e52
SHA1 8f4723d26f334f98349e237fb58e6df7791c24fe
SHA512 2667bca82d042cbb0f8d1140ee74efdd8e7d4e81881b7ecee337ea03506533055c382f176ee34ece15245584163d7ff3c796a1612cf5b38d060d6dcabe387c7a
SSDEEP 6144:BzEuxVrnhbnA4bWqkr3hRpR31HoXr4cDfSNEaFDRXtJ:BzfxVrnhbAVFVKX8SfSNEaFldJ
TLSH
T139248EA13715CE7ED79F03F4A8FB6BBB853951190B7285C3E3492F6856310C22B3661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\7z8FFD25E0\skin.zip
Size 398KB
SHA256 aa40840b724a3c1e1d2d567b7b03b077bbd813268224273511826c5bd4454c10
MD5 d5a974d94c01a270a6f3d5816d2417bf
SHA1 4afe596d9d62b539e861dc66ef963198e320d386
SHA512 9e53dccd2a240985efccb85962a76ac1a07a2260e03171cf02058e7fe362b7efaea7eb0f7860cd8b0109e9a6f60ced7ff6e211108b7ce981cfc3039e730e4d2d
SSDEEP 6144:kRsoSTx0vEyyfDRqwg/d1SQC+HxzG96e3Pi1GG1x8ZFE7gI8L:csfDLpg/d5CAD8jE7gFL
TLSH
T19A8412DFF721A08AC69FA778510700526D3E5897C531BB4A1CB248645BCFEF406AA39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download