9c6df3feefde26d4e41d4a4fe5db2a89f9123a772594d7f59afd062625cd204e

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
comic32.exe
Size 240KB
Sample260706-pdasjsax4m
SHA256 9c6df3feefde26d4e41d4a4fe5db2a89f9123a772594d7f59afd062625cd204e
MD5 2b30de40bb5e803a0452c7715fc835d1
SHA1 2371d0327683dcc5ec1684fe7c275a8de1ef9a51
SHA512 6ad11015d568d58f6e4375e04411dd702b5c4e454b82998b5044cd8352dae27fea1df6469a05067ccc8c14f4ba87ec99e8329c104551dde1eb48be8ce2b78708
SSDEEP 3072:Xu5fbJfDA1yl3UTJt5FIQGTRgfcCn4Q2qRVCZPToOc3xzFo7kN3tAzE/sDquAC6z:qFfDAEl3VQGlMcEV9N27kHAZDo5xV
TLSH
T1A834E0126BE8093BF0F51B7009F502536B36BDE56EB9E3AF0241806D1D737946A3972B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6132	fontinst.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	comic32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	comic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontinst.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5880 wrote to memory of 6132	5880	comic32.exe	89

C:\Users\Admin\AppData\Local\Temp\comic32.exe
"C:\Users\Admin\AppData\Local\Temp\comic32.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fontinst.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fontinst.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Comic.TTF

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Comic.TTF
Size 123KB
SHA256 b82c53776058f291382ff7e008d4675839d2dc21eb295c66391f6fb0655d8fc0
MD5 a50f9c96a76356e3d01013e0b042989f
SHA1 d17fae7a6628e2bc4c31a2074b666a775eed9055
SHA512 d24bffcc41d05f7c81650f119356113dcf8dd1fe52296b5dd39de15eb99b58b36ca3655efb0c42b40003752d14a9f13de78ac7a9d9a83a137e9dfb565d8bc0ac
SSDEEP 3072:f6wJzBN2+qQ/o289cscEhIJyk+NkRn6C71fru:ikzn2+qQo28YdskNR6CRu
TLSH
T101C3BF87C3FADD1EF66AA2B8D520B74345FBB95CE778437BBA4A508EE408150C58E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ComicBD.TTF

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ComicBD.TTF
Size 108KB
SHA256 873361465d994994762d0b9845c99fc7baa2a600442ea8db713a7dd19f8b0172
MD5 81d64ec3675c4adc14e9ad2c5c8103a7
SHA1 5518f0bdebe7212d10492ab6f4fff9b0230c3cbe
SHA512 20004d91e4acac518e22550159ebaa004f1a22630910f3888056293d8a12bf18c6a7e7cbaac214fe2a8fd7a5915ba2138db66084607a5675fc9224b33b6bec99
SSDEEP 1536:+m1aokaMXiBM2R5tYOLTiq96IBziENRdP1t8b9SW0luW5N4Tev9u5nL6Vfrl:+QaOBM2RnY+b3UENPNmUWe0tL6Vfrl
TLSH
T139B37C03D3BADC5EE6AEE3F8D540F71644FBF86CEA3A036FB985515EE848510856A301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontinst.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fontinst.exe
Size 43KB
SHA256 4d9becb13049c035613353b1a08b35a1f0d3ca7bf552ca143039d16227b5b148
MD5 50fce96d542cb82bb2422df04ff0a1c2
SHA1 411101b4a505079019119c80f609fd4b97e75103
SHA512 9c1b2dadbe18011ed5a97957dc20297ff0fc650500a197c08585c7462bd0bd89aefcd01555445282a95530caa28acf4438e0256a56b08e6e8b5ed366af2d4f64
SSDEEP 768:pjAk8APNcYMkBz+X7pxPv7PooF/ah3acDpJngJnhj:JcARBY7nn7P/F/aNa4pJngD
TLSH
T1AF134B43A990C0F2FA91263810EBDB76DF3B551A02369707DB64DCB77C73251E82939A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontinst.inf

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fontinst.inf
Size 33B
SHA256 41ed7308148d8474dc369549362ca967498ac96b55d6fc01448c506c9a0d6ca8
MD5 eb6497b9b93d03d02c9792f604882d9d
SHA1 d7f3e7f19a0b14b87bf899091d97561fc5c08fdd
SHA512 95c38a16218f1516c77b08ffb5238d40341922b7b508c0905e77cd71fa4faf6e2551ac53433913cdff6a1868f42cacc2e525f9ce50af5440c3e335b0f40efbe6
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads