Analysis
- max time kernel
149s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/06/2026, 19:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fontdrvhost.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
fontdrvhost.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target fontdrvhost.exe
- Size 821KB
- Sample260626-x9ny2set8y
- SHA256 fec0c85ffdceab2d739114f6f04534250381860b0ac0859f8474f85e042001ee
- MD5 e3b7f9d52327e9010eb53beb6f7c3a9d
- SHA1 5ef58fa96fc28360ea41d0802d4f7dce22249397
- SHA512 b5792b68c96897b839bc3109e81dfc110499e027805dc156aa797a4f41d7b322db85f430315f4759d8b64ac0af5d4e8d7ef76d2d2b6f159e3cbd23b1cae8f3dc
- SSDEEP 12288:d58vIQLuLqVItq+I7+AubTctrcH0T26J6etHSbIiC9nFxgoh2:z8bLKUI037+xbTQrcH066JVjiWnFqE
- TLSH T11705AE45F2B900FAD07B9138D59ABA0BEA763809071069DB13D5469C3FB77E41BBB312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 980 fontdrvhost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3604 PING.EXE - Runs ping.exe 1 TTPs 1 IoCs
pid Process 3604 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe 980 fontdrvhost.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2204 wrote to memory of 5364 2204 fontdrvhost.exe 90 PID 5364 wrote to memory of 3604 5364 cmd.exe 92 PID 5364 wrote to memory of 980 5364 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mako_upd.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Windows\system32\PING.EXEping -n 3 127.0.0.13⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3604
-
-
C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:980
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\mako_upd.bat
- Size 226B
- SHA256 432f214fea080bdff83321c7f1fb1247b76fa2bdf67e2ba39f173bd0091b11cc
- MD5 3d8a8a0d797d92966d7fdff1e2effd1e
- SHA1 d4e0f59f7cae83c2aba565d4e8fac6d5a2505cfd
- SHA512 67931182319bd59ecfc4555cb62bc0d9f2387771c717f958ea65424756939868b007b8b049f35045f395fdd1ecd6e7b88ef87a242af7525e045f65d9ef5043a7
- TLSH T1D2D0A9038197CE3E580AA82724FAA24DD0A2489E3F443FD08601880E12C280EFBCB301
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mako_upd.exe
- Size 938KB
- SHA256 bafbc85cc392cc2f652979bf4dc54542168d2749f3a8a58a061d4590b7db2494
- MD5 9351fa4cf054f2a0545a5d0da434a5d1
- SHA1 5d0d331b43dfdcf18783f9757ce5be6cb787ac98
- SHA512 56db5cbcce1449c36d30712a499236f2ad84aecbeeee6c4687048511fa3af19fda4376551cc9920d800974cf542423cfeff7b11530e718a84ea3dc4ed54e9ce2
- SSDEEP 24576:n9VrJxDE3Edqx4L9maOewRi1ngss+Lct:9zxDE3R4Lcat1nFat
- TLSH T1B815BF45F2B901F9E07BD178C966A60BFA72384A07205ADB13E046591FB37F41EBB712
- MD5 SHA1 SHA512 SSDEEP TLSH