Overview

overview

7

Static

static

3

b02b64d21c...a7.exe

windows10-2004-x64

7

b02b64d21c...a7.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 23:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b02b64d21c99ad95dce8ec4d033eb3c0687bf220253be656a9b9859da46e36a7.exe
  • Size 12.1MB
  • Sample260708-29be6sbt2w
  • SHA256 b02b64d21c99ad95dce8ec4d033eb3c0687bf220253be656a9b9859da46e36a7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • Loads dropped DLL 24 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b02b64d21c99ad95dce8ec4d033eb3c0687bf220253be656a9b9859da46e36a7.exe
    "C:\Users\Admin\AppData\Local\Temp\b02b64d21c99ad95dce8ec4d033eb3c0687bf220253be656a9b9859da46e36a7.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4700
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im gsMultimedia.exe -f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1472
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im gsMultimedia.exe -f
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:696

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CPKernel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\CPKernel.dll
        • Size 307KB
        • SHA256 7dc3a3e3f73ee52e30f0d1acb5fb76445ef0c22d263ec5ed8ada7bb2b8bc1893
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CPReader_English.ini
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\CPReader_English.ini
        • Size 16KB
        • SHA256 951f05138a2ea3f0feaeeee5bfcc7927514649d49b1d128cc7726cb3526c77c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GImageView.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\GImageView.dll
        • Size 543KB
        • SHA256 c85ca44b1ff1ad0af0ca3daf5f2302498846f3fdc2f48c6c7262f08280c6f5fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ImageZoom.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\ImageZoom.dll
        • Size 276KB
        • SHA256 72a81d79b8b670f2650c546369b5961579607ccbbbb7da0af4878109051bf428
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Player.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\Player.dll
        • Size 80KB
        • SHA256 deda5eefa6c427b3ba9af0696ddcc15681f7dd2cb2f047df01dccbd97495d1a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\SDL2.dll
        • Size 1.2MB
        • SHA256 5ff3186465a347ce8a13991fdb659f77ee21ae5dc9813b9fb2aadafda8a86491
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SharpWnd.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\SharpWnd.dll
        • Size 281KB
        • SHA256 2ad9292c875cb8b71a437b0da803d07867d2ed8deae4568f2be1f623755d5b60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        avcodec-55.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\avcodec-55.dll
        • Size 9.3MB
        • SHA256 2be959285f432eec4115a9d3d945b9594b5356b4d8d5774ae4b3de82bcec33e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        avfilter-4.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\avfilter-4.dll
        • Size 1.5MB
        • SHA256 bfc20232c4ecf4aece403d005624c82a64a2d54d5d84720341dc6d45b3522ba5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        avformat-55.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\avformat-55.dll
        • Size 1.2MB
        • SHA256 29ef7a1689a904d4d2d7d5bcb9f255eb15118901ddd67c7c8128b68f05d5fa92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        avutil-52.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\avutil-52.dll
        • Size 327KB
        • SHA256 67a0f7d47ceff1407b9c4851032346a9b81a75fee6569274f15d092610f04cdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        corem.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\corem.dll
        • Size 52KB
        • SHA256 deac6221d0abe480012e836e5e9dd915828ae55401f0c46fb7ce8049c380c698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        corez.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\corez.dll
        • Size 92KB
        • SHA256 00d4986dfff92cfdd45576da9100d49f374a8dba1a476cfc8dc7cf50f5a6735f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        postproc-52.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\postproc-52.dll
        • Size 185KB
        • SHA256 72180a408b13b7d98c0bc2395b886a5c3aa0b2dea39ef081e193f60ef373365f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pthreadGC2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\pthreadGC2.dll
        • Size 68KB
        • SHA256 72e6c8dd77fa7e10a7b05ef6c3e21d3f7e4147301b0bf6e416b2d33d4e19a9c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pthreadVC2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\pthreadVC2.dll
        • Size 44KB
        • SHA256 ee15e6e3f82c48461eb638c1ea11019ae9e3e303e067e879115c6272139026e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        swresample-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\swresample-0.dll
        • Size 101KB
        • SHA256 d179c01c646d821cf745ae5e66ffc7ed394a61a595ecc2bccf27dc144ba91a2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        swscale-2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\CPReader\1.0.0\20260709001632785\swscale-2.dll
        • Size 490KB
        • SHA256 4f17b1ceea162390f64f54a3d13de4bb9e553da1e51ae7061545b7843ddad9ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.dll
        • Path C:\Users\Admin\AppData\Local\Temp\gs_6578.tmp\7z.dll
        • Size 709KB
        • SHA256 6c80e3f49fcf561e6a0b52f9b4c81d1d07b22085f7864ee4cfd30dd10f6b3b12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        watermark.png
        • Path C:\Users\Admin\AppData\Local\Temp\gs_6932.tmp\watermark.png
        • Size 8KB
        • SHA256 d673a19b5278cdea8df23d3206166e0ececa6fd383cb13020ff3d1909686f64d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4700-168-0x00000000075A0000-0x00000000075BA000-memory.dmp
        Download

        memory/4700-165-0x00000000071F0000-0x0000000007200000-memory.dmp
        Download

        memory/4700-0-0x0000000000562000-0x0000000000564000-memory.dmp
        Download

        memory/4700-164-0x0000000007200000-0x0000000007219000-memory.dmp
        Download

        memory/4700-162-0x00000000071E0000-0x00000000071EB000-memory.dmp
        Download

        memory/4700-1-0x0000000000400000-0x000000000102F000-memory.dmp
        Download

        memory/4700-174-0x0000000000400000-0x000000000102F000-memory.dmp
        Download