3c399e4c4826de5f378e1da9a9e54c29bf8d557aae01f53d307c4bf565d03194

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hui.exe
Size 323KB
Sample260712-t79aesfv2z
SHA256 3c399e4c4826de5f378e1da9a9e54c29bf8d557aae01f53d307c4bf565d03194
MD5 c76b0867436829232609a7f6c786c37c
SHA1 06d88a277a77db9494feca72c31a35af3f83a4f8
SHA512 9047a8ac3a2795c73e5650ce37d0595798532579ca4013f2498e9641796d9814aba1d138812ee28135edd4b48843f58063c278511c4279ee3afbd422a683359d
SSDEEP 6144:4a8JsLcpjzTDDmHayakLkrb4NSarQWtT+tG1Xh:kzxzTDWikLSb4NS7ET+tG1Xh
TLSH
T15C64CF02FDC195B2C5210D325A29AB61253D7E201F248EEBE3D46E6DE9341D0FB35BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4500	huii.exe
1260	hui.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hui.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	huii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	huii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	huii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	huii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	huii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	huii.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 4500	2656	hui.exe	88
PID 4500 wrote to memory of 1260	4500	huii.exe	89

C:\Users\Admin\AppData\Local\Temp\hui.exe
"C:\Users\Admin\AppData\Local\Temp\hui.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\huii.exe
  "C:\Users\Admin\AppData\Local\Temp\huii.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\hui.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\hui.exe" xui2
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hui.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\hui.exe
Size 5KB
SHA256 e60353b37f785c77e1063ac44cba792e9ec69f27b1dc9f3b719280d5ce015cc0
MD5 17b935ed6066732a76bed69867702e4b
SHA1 23f28e3374f9d0e03d45843b28468aace138e71c
SHA512 774ea047cdc5f008df03ad67242df04d630bb962bc99f1ea8974a21baf6a902c7a5d8b8d09d9e5c7d7e46b0378c7baf33bf80fb3e34777cd0958b8fc740d0318
SSDEEP 96:2AY3+z86Wt3VGEwMO54w802Sug8kiBzNt:FYe86WGhMO54w81jJD
TLSH
T134C10A29C3C80A76DD720F325A7743025378E1968E6FAFAEB79401572D2D3145E233E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xui2.cur

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\xui2.cur
Size 4KB
SHA256 de7c8bd93cc576d719805835099ae0f2cb88d797fe71585e2f7eb56b67a8fb72
MD5 c1fd2feb9e2b56be00082dd06c2b9658
SHA1 6e9272d5d53272f901ebb75ea556e250d4fc54aa
SHA512 7530ad40f0adc93d5166b2b4741ba66bc5792ca1882be658b86b290feaa3ccf08f15ef0d55cc40494c6f3fedb78ecc5dab2a5342e0bdc85a068a3a0ffdc6e79a
SSDEEP 24:DeoFGmUIE7rhudgnvG256A+4Fu86wtBR/lFKJXi07QtfsrbjRnK6I6yK:CoF2nhRnvG25r+41BRlu0tfs/jlK6I3K
TLSH
T1D6919B36F642F91AD1C83E7226143FDB04CE8EE161154742CAF5393E2DEA30695ED2D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

huii.exe

Path C:\Users\Admin\AppData\Local\Temp\huii.exe
Size 313KB
SHA256 acc6fecd839b1de178b5d17525b3764fb7511e589ae04f6217666e869cacce91
MD5 c125391f5a989f964548e45decc7490e
SHA1 08906a336b65dbb61cfc0b95f11315f18a5301f8
SHA512 9a6b36c78b9016f662124f4761d4ad42965748259fba7f8fc59730d0fbd63b151ff34b650019645fe845659ea024e9a9f173c55427aced781b5e5a6938b8dd3d
SSDEEP 6144:H8JsLcpjzTDDmHayakLkrb4NSarQWtT+tG1Xx:8zxzTDWikLSb4NS7ET+tG1Xx
TLSH
T15B64BF02FDC195B2C5210D325629AB61253DBE201F248EEBE3D46E6DE9301D0FB35BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1260-23-0x0000000072A32000-0x0000000072A33000-memory.dmp

Download

memory/1260-24-0x00000000002D0000-0x00000000002D8000-memory.dmp

Download

memory/2656-8-0x0000000000400000-0x0000000000458000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads