8361adf3c0574261510b3ae887e8c50b003bba62da3119ec01e1891298787933

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MuMu_6.0.1_Qo25l1C.exe
Size 5.8MB
Sample260710-d81fxadz4x
SHA256 8361adf3c0574261510b3ae887e8c50b003bba62da3119ec01e1891298787933
MD5 e2d77fe5a406b3e7ebfc9263b4e53258
SHA1 fdb970321d8ec9cd93e7bef0bfc3caa7cb5c9ea8
SHA512 63109990b48127ad6167fdc5e68fb51c4391920dd050249f41d1187234b45b0f9d307fb4d6c7fa632f9e5c5cfae02b66558b42026cf290d35e962d96b3ff3f5d
SSDEEP 98304:oer6uFFkOuPB3cjtFYEUO9u97ZmKdlhqap1ZcWDtIELv9VCOxeI+S0bIwrSwVNJz:1r6uFFkOuPG7c7ZHlLbjXLWjI+SvFCjz
TLSH
T119562392D601B3B2D41E5DFC512D87B6FE933CDE6C482C46018EF1ABB0AD5612E858DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	nemu-downloader.exe

Executes dropped EXE 6 IoCs

pid	Process
4336	nemu-downloader.exe
5380	crashpad_handler.exe
3792	ColaBoxChecker.exe
3392	HyperVChecker.exe
1568	HyperVChecker.exe
716	HyperVChecker.exe

Loads dropped DLL 5 IoCs

pid	Process
4336	nemu-downloader.exe
4336	nemu-downloader.exe
4336	nemu-downloader.exe
5380	crashpad_handler.exe
5380	crashpad_handler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MuMu_6.0.1_Qo25l1C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nemu-downloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColaBoxChecker.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4336	nemu-downloader.exe
4336	nemu-downloader.exe
4336	nemu-downloader.exe
4336	nemu-downloader.exe
4336	nemu-downloader.exe
4336	nemu-downloader.exe
4336	nemu-downloader.exe
4336	nemu-downloader.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 4336	2800	MuMu_6.0.1_Qo25l1C.exe	86
PID 4336 wrote to memory of 5380	4336	nemu-downloader.exe	87
PID 4336 wrote to memory of 3792	4336	nemu-downloader.exe	88
PID 4336 wrote to memory of 3392	4336	nemu-downloader.exe	91
PID 4336 wrote to memory of 1568	4336	nemu-downloader.exe	93
PID 4336 wrote to memory of 716	4336	nemu-downloader.exe	95

C:\Users\Admin\AppData\Local\Temp\MuMu_6.0.1_Qo25l1C.exe
"C:\Users\Admin\AppData\Local\Temp\MuMu_6.0.1_Qo25l1C.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\nemu-downloader.exe
  C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\nemu-downloader.exe
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\crashpad_handler.exe
    C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --metrics-dir=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --url=https://sentry.netease.com:443/api/325/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=d7282c50f1b64296835edf7d19667322 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\132046f2-323a-48f6-581d-02bcf65f3682.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\132046f2-323a-48f6-581d-02bcf65f3682.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\132046f2-323a-48f6-581d-02bcf65f3682.run\__sentry-breadcrumb2 --initial-client-data=0x398,0x39c,0x3a0,0x374,0x3a4,0x74e64800,0x74e64818,0x74e64828
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5380
- - C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\ColaBoxChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\ColaBoxChecker.exe" checker /baseboard
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3792
- - C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:3392
- - C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ColaBoxChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\ColaBoxChecker.exe
Size 4.0MB
SHA256 65aa91ee18b46603a5543fdd398d6331a9f77eb8a16a6933f2fe576fc62d6941
MD5 a6d0d421e32946a34de15e4e397ec0b0
SHA1 bc15a70e4d1f9815cfe8d2532d447f0702bb18f0
SHA512 b7817f72fabbf2017d91d48765b2bba83f784d7e02107695f8a7584f8834a12b0a745688d3cbede795b14afe7de4007442f8c96fcc0059b2af309c1ea1493e43
SSDEEP 49152:1gP8dFBouKaau2VgFLTeJxx8IHqQOPclSWkar66Dv4TpN1KjH304dAHRvOA:WP8dFuudB0gFLQ2QOQ660TpN1eX3dC
TLSH
T1DB167D31370BC135FF8281B7456DABAB437C8A650B7340DB92D42BBAD9352E22B35D52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HyperVChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\HyperVChecker.exe
Size 118KB
SHA256 d545ed2dfc015f965d35dc4950fe773cb94103a685d3c25c4b44fcb466a85662
MD5 ba1dd89be69ee0e03af11d90785b5b00
SHA1 8d46e63b0b9635ebcf79ab46093832dc4936b800
SHA512 ca33b083b717c2cb1f40fe6eb96b52b71ede808c1d09c782d659aa7ab6034fa612326f17ad4db0b8ed9f1ae2e8633db54f89ea95536a856f338dfe3286e9d6f7
SSDEEP 3072:0wLn2WoLPivTkgxUJ8UrtmMx7bB5dSUo+WziN:Jn2WoLP++J8Upo+WM
TLSH
T193C37D57A3E434F9E17B9638C8910A49DB72B87207609FAF03A442961F637D25D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\MSVCP140.dll
Size 427KB
SHA256 8acd9e63a83f2facfc68b801f864f923eac5fb8c8a046a32fef8d622ba7d407f
MD5 77e799e61066dfb983babee530e22fd1
SHA1 659484995b44b5d6e7d22d52abbfa2f68e27d32e
SHA512 e942da491509ce781abc2ea099fea110df076d264053b92a836428fcae82e29e07351f6678aa884ec26dd12230c864d3bfbd1058ecc94c89baa0cd5dd1826744
SSDEEP 12288:+LxU+0XySH2CyKSPRBb22umby6hUgiW6QR7t5s03Ooc8dHkC2eskI4j:wxUwSH2CyKaBb22umb203Ooc8dHkC2e7
TLSH
T121943932BB460DF1E48913B971C9472193FAFC610362E3C397DAF1262F566C6A633A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\VCRUNTIME140.dll
Size 75KB
SHA256 526d8774c67248aa62a5911acd7db667cc4bed5be2cd5dc139c6c4d5dfb9d57e
MD5 dff7397268e74ff615529032a9af2ccb
SHA1 68a671e4634825684494e45d7724a64b5146b3eb
SHA512 c0928d3c0e997bcc082530ff565569267f9e307f45f796a0f62c76f66c6121674d87123af19993f2b9f40dd7f059d1ded51c29d5d11b8dc47802cc83690e6d0f
SSDEEP 1536:c6H1qvERANBw6qntn64lqVwhNDyUZXRqtnHEecbCBg6yzT:c6HMMRANK6qtnsVON7JYkecbCBQ
TLSH
T1FE739E5274C48272C5AE4AB9017AF612663DAA604FD15FDB7FD8598C9B79BC0EF30203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baseboard

Path C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\baseboard
Size 114B
SHA256 a4ff1612277695255860952d81fc22da76e4ab88f1b4a1fdc08916b15909a5fb
MD5 7a224364e66bafc544b1bab945eb0a1b
SHA1 fd85d98dac92d620986df6264282a65b9775acf0
SHA512 5d1baf7bd4800370d40d847820d1d016df1f57fbbc3b2fc388352401a83978d36c9289416721cf462b803810b6ba594a54ca2a71ca22dc6d9593e01650dabbe3
TLSH
T1B7B01278E0C32C13D00B9C04003B44EA35408C638B006CB0770B097C1B4847A2F97ADC
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\config.ini
Size 346B
SHA256 a3f8c3a0f3cbb1712c8447e190c642fa0583363f255396edf431c464d5095250
MD5 6e2749845492421951c582a41132b2a7
SHA1 66a9b63e5d17cd836bb107fe70d06155c87e9fcf
SHA512 4c7472d0482077f5908724674fe3708396185224b016824056b9219e3de48f0461524e5a05d133bc502002cc1670e352219090d8699a6904cc6e7c181f026673
TLSH
T140E0ED7916128916B2007EC9250B3301AD3AF1E37E408091EA2CA5A5B923D66822380A
MD5 SHA1 SHA512 TLSH

Submit Download

crashpad_handler.exe

Path C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\crashpad_handler.exe
Size 542KB
SHA256 9769c585019a1a19d96dc0f378bd90240015a54ba77288b2efc995f791a49bc0
MD5 9ba1e7d7bfce0e9e0d52f33ef5e01e91
SHA1 5e301c6d74602e30ecabd1e445dc334440b2e07c
SHA512 aeb4c76a23bf8664c140035491f3747a6a39b4f118dd12177e5b0aff021d33ff7a3903af22dc37cb350e582ca94dcdc6d64cb204c11f50b2caa7acf643dae00e
SSDEEP 12288:reAQnPupDjbkEW1b4uifVysTVRAtCX/BJ2LoUG3zi8SrcOTFJMjlgPrdhfbTh0aI:reAQn2ptXX5J6Gj/SrcOTFJMjlgPrdhW
TLSH
T12CC48D707A2AC136D25291F15C59EBF790AC991A4B7308C3B3C95B396A712D32F32937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nemu-downloader.exe

Path C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\nemu-downloader.exe
Size 3.5MB
SHA256 e5b377e0fe13e27a21723dcd61fe2dcab988ea439426f6a65fb253acb205bff5
MD5 ff519fa7e3d8494dcb3f1282010b9ee8
SHA1 fdd80e1fb266ba29046a6c3e2bdc90ebab001890
SHA512 76b844efa370d6095037086bd6546cfceff5076fc793d439c29e4c7c3907530639d2e39dace93f2126cb310a3d6e66b9c8ff5577aefba4d221cfb67025213ed2
SSDEEP 98304:TiKbP5Ku3cDjEL3b/xF9y1+r0+gUzGMaS/b2IBbcrSFoR6uFFkOuPXNX:OKbPb3mgL3diOaS/b2IB0JR6uFFkOuPh
TLSH
T1D8067C01B791913AF9F305BAC9BE561E443D7E311B2880C793C45A5F2AB6DD23A31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sentry.dll

Path C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\sentry.dll
Size 223KB
SHA256 2e108ccbbd47997978512835013d06500bef5575f29cb937f623d30596662819
MD5 2c886b7927c0748042a5e294fba28e52
SHA1 8f4723d26f334f98349e237fb58e6df7791c24fe
SHA512 2667bca82d042cbb0f8d1140ee74efdd8e7d4e81881b7ecee337ea03506533055c382f176ee34ece15245584163d7ff3c796a1612cf5b38d060d6dcabe387c7a
SSDEEP 6144:BzEuxVrnhbnA4bWqkr3hRpR31HoXr4cDfSNEaFDRXtJ:BzfxVrnhbAVFVKX8SfSNEaFldJ
TLSH
T139248EA13715CE7ED79F03F4A8FB6BBB853951190B7285C3E3492F6856310C22B3661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\7z9BF50AF0\skin.zip
Size 398KB
SHA256 aa40840b724a3c1e1d2d567b7b03b077bbd813268224273511826c5bd4454c10
MD5 d5a974d94c01a270a6f3d5816d2417bf
SHA1 4afe596d9d62b539e861dc66ef963198e320d386
SHA512 9e53dccd2a240985efccb85962a76ac1a07a2260e03171cf02058e7fe362b7efaea7eb0f7860cd8b0109e9a6f60ced7ff6e211108b7ce981cfc3039e730e4d2d
SSDEEP 6144:kRsoSTx0vEyyfDRqwg/d1SQC+HxzG96e3Pi1GG1x8ZFE7gI8L:csfDLpg/d5CAD8jE7gFL
TLSH
T19A8412DFF721A08AC69FA778510700526D3E5897C531BB4A1CB248645BCFEF406AA39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download