Overview

overview

7

Static

static

1

MuMu_5.0.1...aC.exe

windows10-2004-x64

7

MuMu_5.0.1...aC.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    222s
  • max time network
    197s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 18:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MuMu_5.0.13_PMNDGaC.exe
  • Size 5.6MB
  • Sample260703-xjd16abs2m
  • SHA256 efa0ed24d8b1b90b876315c020d9f82454db9e293e3c3842c639069828180b5a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discovery

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MuMu_5.0.13_PMNDGaC.exe
    "C:\Users\Admin\AppData\Local\Temp\MuMu_5.0.13_PMNDGaC.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5196
    • C:\Users\Admin\AppData\Local\Temp\7z832BA44C\nemu-downloader.exe
      C:\Users\Admin\AppData\Local\Temp\7z832BA44C\nemu-downloader.exe
      2⤵
      • Enumerates connected drives
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Users\Admin\AppData\Local\Temp\7z832BA44C\crashpad_handler.exe
        C:\Users\Admin\AppData\Local\Temp\7z832BA44C\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --metrics-dir=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --url=https://sentry.netease.com:443/api/325/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=d7282c50f1b64296835edf7d19667322 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\47b13723-2b57-48a9-d9fc-2e326d50a184.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\47b13723-2b57-48a9-d9fc-2e326d50a184.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\47b13723-2b57-48a9-d9fc-2e326d50a184.run\__sentry-breadcrumb2 --initial-client-data=0x39c,0x3a0,0x3a4,0x378,0x3a8,0x75854800,0x75854818,0x75854828
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2708
      • C:\Users\Admin\AppData\Local\Temp\7z832BA44C\ColaBoxChecker.exe
        "C:\Users\Admin\AppData\Local\Temp\7z832BA44C\ColaBoxChecker.exe" checker /baseboard
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3000
      • C:\Users\Admin\AppData\Local\Temp\7z832BA44C\HyperVChecker.exe
        "C:\Users\Admin\AppData\Local\Temp\7z832BA44C\HyperVChecker.exe"
        3⤵
        • Executes dropped EXE
        PID:6456
      • C:\Users\Admin\AppData\Local\Temp\7z832BA44C\HyperVChecker.exe
        "C:\Users\Admin\AppData\Local\Temp\7z832BA44C\HyperVChecker.exe"
        3⤵
        • Executes dropped EXE
        PID:2520
      • C:\Users\Admin\AppData\Local\Temp\7z832BA44C\HyperVChecker.exe
        "C:\Users\Admin\AppData\Local\Temp\7z832BA44C\HyperVChecker.exe"
        3⤵
        • Executes dropped EXE
        PID:6356
      • C:\Users\Admin\AppData\Local\Temp\7z832BA44C\7z.exe
        "C:\Users\Admin\AppData\Local\Temp\7z832BA44C\7z.exe" a -tzip "C:\Users\Admin\AppData\Local\Temp\nemux.zip" "C:\Users\Admin\AppData\Local\Temp\nemux"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5712

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7z832BA44C\7z.dll
        • Size 1.1MB
        • SHA256 2dd983dc3953873dfd71647c0bf051e55de2aa63e232946cce68f577beb4923a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7z832BA44C\7z.exe
        • Size 296KB
        • SHA256 b698aa8baf0b3788933ab3567cf8c44a425a89c049b812f9cfcd78785172cb88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ColaBoxChecker.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7z832BA44C\ColaBoxChecker.exe
        • Size 4.0MB
        • SHA256 65aa91ee18b46603a5543fdd398d6331a9f77eb8a16a6933f2fe576fc62d6941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        HyperVChecker.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7z832BA44C\HyperVChecker.exe
        • Size 118KB
        • SHA256 d545ed2dfc015f965d35dc4950fe773cb94103a685d3c25c4b44fcb466a85662
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7z832BA44C\MSVCP140.dll
        • Size 427KB
        • SHA256 8acd9e63a83f2facfc68b801f864f923eac5fb8c8a046a32fef8d622ba7d407f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7z832BA44C\VCRUNTIME140.dll
        • Size 75KB
        • SHA256 526d8774c67248aa62a5911acd7db667cc4bed5be2cd5dc139c6c4d5dfb9d57e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        baseboard
        • Path C:\Users\Admin\AppData\Local\Temp\7z832BA44C\baseboard
        • Size 114B
        • SHA256 2b712dc663c5ca9984f58a83a001359420a2ba5f54eb237694ed6b702f447961
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        config.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7z832BA44C\config.ini
        • Size 326B
        • SHA256 80ac6767a2c440b074e564a2a4c2f7ee3860db2af3938a19f3d44552ed0aa1bb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        crashpad_handler.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7z832BA44C\crashpad_handler.exe
        • Size 532KB
        • SHA256 eddcaf280d2b2b82df7a40eb9506909a53c7ee6e95484614dc395e9575db8a35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nemu-downloader.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7z832BA44C\nemu-downloader.exe
        • Size 3.4MB
        • SHA256 4ce5dccd2aa932c727e58fcd90135f4757a8465f83b008e84a18182435ffdb20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sentry.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7z832BA44C\sentry.dll
        • Size 213KB
        • SHA256 cbd0d903c4c532717ee47eb61f0fc42a6e1ed466a6d6c06d810553173025de22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        skin.zip
        • Path C:\Users\Admin\AppData\Local\Temp\7z832BA44C\skin.zip
        • Size 190KB
        • SHA256 6809258a333b1fc4fcaaac09d42aeffbcd1861c8a534d2aadada6f9fbb7dabfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nemux.zip
        • Path C:\Users\Admin\AppData\Local\Temp\nemux.zip
        • Size 22B
        • SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
        • MD5 SHA1 SHA512
        Submit Download