81287f5d3013035ada017017af31c3f2b15dfa53e2ccd3fe08b31572b1119e4d

Analysis

max time kernel
149s
max time network
88s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 07:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
81287f5d3013035ada017017af31c3f2b15dfa53e2ccd3fe08b31572b1119e4d.exe
Size 9.4MB
Sample260710-h73xvsft3r
SHA256 81287f5d3013035ada017017af31c3f2b15dfa53e2ccd3fe08b31572b1119e4d
MD5 03da385e8e9a63c8af7fdd3103193c44
SHA1 c0782e18311e58d344d8aa59184b7bb1e1851f63
SHA512 daa04bbdb56771d8ea31b07772995db8e3affeb3a3fd9b2c670c90719119ba37cb3ced979cefe24a016ba876f8af9f73d46e1948c4b2320b63b2aae83eb13744
SSDEEP 98304:biEAe27iAnZFk4pAuLyAwTHHzCzram2SJnG8x4KxsVkJEMjgpt2ziK+:biEA1iGZFnAuEzS2d9KHuMjgpMg
TLSH
T196A66C12B346903FD0772E3A482F9BD0693BB66139218C1B3BA46E4C5FB5B447E26747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
6	2272	81287f5d3013035ada017017af31c3f2b15dfa53e2ccd3fe08b31572b1119e4d.exe
7	2272	81287f5d3013035ada017017af31c3f2b15dfa53e2ccd3fe08b31572b1119e4d.exe
4	2272	81287f5d3013035ada017017af31c3f2b15dfa53e2ccd3fe08b31572b1119e4d.exe

Executes dropped EXE 2 IoCs

pid	Process
4412	AutoUpdate3.exe
5604	TaobaoTool.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4308	5604	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81287f5d3013035ada017017af31c3f2b15dfa53e2ccd3fe08b31572b1119e4d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoUpdate3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaobaoTool.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2272	81287f5d3013035ada017017af31c3f2b15dfa53e2ccd3fe08b31572b1119e4d.exe
5604	TaobaoTool.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 4412	2272	81287f5d3013035ada017017af31c3f2b15dfa53e2ccd3fe08b31572b1119e4d.exe	86
PID 4412 wrote to memory of 5604	4412	AutoUpdate3.exe	87

C:\Users\Admin\AppData\Local\Temp\81287f5d3013035ada017017af31c3f2b15dfa53e2ccd3fe08b31572b1119e4d.exe
"C:\Users\Admin\AppData\Local\Temp\81287f5d3013035ada017017af31c3f2b15dfa53e2ccd3fe08b31572b1119e4d.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Users\Admin\AppData\Local\Temp\AutoUpdate3.exe
  "C:\Users\Admin\AppData\Local\Temp\AutoUpdate3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Users\Admin\AppData\Local\Temp\TaobaoTool.exe
    "C:\Users\Admin\AppData\Local\Temp\TaobaoTool.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5604 -s 1492
      4⤵
      Program crash
      PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5604 -ip 5604
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoUpdate3.exe

Path C:\Users\Admin\AppData\Local\Temp\AutoUpdate3.exe
Size 2.4MB
SHA256 467c77c7845f52ad9c4078c8e810cc721056732a2e6e538eee4612f63f35b8ca
MD5 296c506d0f6a273a4900a12566537198
SHA1 ca4bc529abe3fc815786a641f62b84ac16142037
SHA512 9dfe621ef7357fb3252697f740f5e9d2a14ff0263549a6cdbe73e282416158f5b6f2862636992adadc1ff53b9e58b93be6ab7b6ace68192597292ae7383f05c0
SSDEEP 24576:W36QVo8fBJd9DRUIo8PePz087KQUgXckrLLBQSdn0nc1mUrQLh4juJC5apLrrTK4:u7XxyRrLLeSdn05UrQWurpTTKvjv9M
TLSH
T110C56C27724C657EC46F3A3765B7B7105A3BBAE176224C2717F0189C8F366802E3A647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdate3.rar

Path C:\Users\Admin\AppData\Local\Temp\AutoUpdate3.rar
Size 981KB
SHA256 b5f153e1ce408878d2688319e0e345c29a2a96610cdf8e64f59ef5958b37e775
MD5 22056f4c60390cf629d6d298220e2aa1
SHA1 67a4a14bd50c1544a798cfa49665ef956019d9a0
SHA512 6fa897a87ebe9a3d6ab238a40f3b738309d92389915ba3c389a3ec3a329651f52b4d934ae328fd512f932bbf030815408943f2cd91b694d0121b79e7f25fc6ea
SSDEEP 24576:t6kqMLAj35qCqbiEpOHiPDvbcgAz5ki/yrA:trE75EbiaOHibVAz5ErA
TLSH
T14B2533082145FA31E0CEA9242E630DB6A5537FA7F72452FE75C71F705FB2A612938D88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TaoBaoTool.exe

Path C:\Users\Admin\AppData\Local\Temp\TaoBaoTool.exe
Size 11.5MB
SHA256 8bc3617a17617d01251252984a6adf9d3f726207245b6dd2c136608647a7c6ef
MD5 883f4e6beea2aab4f693825da5009363
SHA1 b500b52d4604c3b1d265b9e2db3ff54e3ef6262b
SHA512 f8143795a9455f6151598d392b39506872b7a90efeb0861100548d9119e3dbcc6017b019bd863c3e4247a9ffdec768eb14a6c091071af9cc739b85959c066563
SSDEEP 196608:p25V2tF3TdtI7vBCceqY8/5/Jgwh4t3I1M/:pcItFjdtevBjg8/JJgwit3G
TLSH
T1DDC66C12B384903BD1779A3A982F97C0693BB7613A269C1B37E40E4C5FB8B457D26347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TaobaoTool.rar

Path C:\Users\Admin\AppData\Local\Temp\TaobaoTool.rar
Size 5.5MB
SHA256 b1668c394d487b949209ce8f076909bc9ea7ebf19aebeb3c620f2a2546599ffb
MD5 cefff81f3a1f0d5fded7a923c2fa69ad
SHA1 99ba428191d0841326837fc18b63c8922a1ea301
SHA512 82cdbba2a8e050ee7b0104167c30d7fcaa8b549555c690f66da8553491df0f145cf0e6c6851f29fbc7a51b89c7148100ced0edaa652bb12f634b495062562aee
SSDEEP 98304:0CHUU0dWn+XMNU9ooyO77/0VpXot3GMFnoWVFFIqBmyxoyFt3cyltYM6A+UjvZ3M:2352UKoyOncbYt3GUVFFI4fxjftlWUju
TLSH
T153463390C28253ADB3926CB37705E8A132E05E21E1BFFBA5FD698CC55C90C6766E51CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\libcrypto-1_1.dll
Size 1.7MB
SHA256 4be46de944af322e6be7340112ac70df81509a1653e695e0687443b5b585fb74
MD5 3a9c1f0b299a42efde8f026e9eea62b4
SHA1 edd2ed78decf6f75296bd600b093d46548c02131
SHA512 221e26376d1cbb20287991b4e0f4e21727d1cae47d61913affbaaa537891a157258ceff0d7fd96feb3ab35580ef5db3734d589ad7096a7a1133c959b850fe92b
SSDEEP 49152:g7Nc3UvQ/qpyr0khPsFCMsTPcOcuU1CPwDv3uF0jaA5ElVq:g7NtvQ/qpyr0khU8MOcB1CPwDv3uF0jL
TLSH
T12E85AF03FB82D9B1E5CB817851B69B3F4D3A9A109324C9D3CB652956CCA26D1673F38C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\libssl-1_1.dll
Size 350KB
SHA256 f34f6420ea0e28b294f47fc988e635e893dd6305d0221e80eb0bc6f14286b509
MD5 415d34ef648c36f42dcedde4b070f5c6
SHA1 8dfa6c3b4a211f2f24946bd15ae5ca282034dd35
SHA512 24813caa817e5a6636e900c6756035dfff746b14afb7a87c5b73f265d4e0af946a31da1509b04821f8a916a84b9fc25f64aea0c9d927f26bd6e31294bf16d177
SSDEEP 6144:sr/EgJhmcR8XEeQHSjQ3B9ctiQl0YiwQwOazjVHrztI86pgz87+T03M6bvP/I8Kx:Y/ECmceXEeQHSjQ3B9ctiq0YiwQnazjh
TLSH
T127748D41FB8258B2E8824774A9BB5BBA7D3DB7008329CCD3976109648D363D4973E79C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2272-25-0x0000000000400000-0x0000000000D8E000-memory.dmp

Download

memory/2272-0-0x0000000000C06000-0x0000000000C07000-memory.dmp

Download

memory/2272-1-0x0000000000400000-0x0000000000D8E000-memory.dmp

Download

memory/4412-27-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/4412-26-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/4412-60-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/5604-62-0x0000000000400000-0x0000000000FB2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads