4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b

Analysis

max time kernel
149s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe
Size 6.8MB
Sample260712-v2fxcset7m
SHA256 4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b
MD5 6b3a07a24419bbd75249bbb4c46af986
SHA1 f605b14aea6b12a6309ed0276a0b8e220ffd9041
SHA512 c9957320c28c36f39e97c67048f39052e99eb1a9a355fc8b84f54e0652b0f34f7ec0adbeca40eb1a87e268e4d9f93e9c91ae9ff4dbe04f82ddb866cfdc009119
SSDEEP 196608:Eo9pwI0xAEF4UFhlUM8P8wceYdObywORMs0Ww1:FyIvEeUFhlUMFFjObybMs+
TLSH
T11266F112BE80C432E5A201729A7D7F694AFDFA311729C5C3ABD9099D4D309D2B739327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories	4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "0"	4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1"	4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid	4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "5plrkb55s2h97ob4ekauqj9zzems"	4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}	4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}	4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "79ad6ee1a0b0cc1c22e576f849459c93"	4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3184	4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe
3184	4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe
3184	4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe
3184	4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe

C:\Users\Admin\AppData\Local\Temp\4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe
"C:\Users\Admin\AppData\Local\Temp\4b62e02bcc911fb09d16670c417d2e47b2714a1a46c5232a5d9940c728908a3b.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hg.dat

Path C:\ProgramData\Kingsoft\KIS\hg.dat
Size 53B
SHA256 0cdbd4a0d668fd6c691e17876f881ce9015d3769a8b167f986008c9f41cd5d50
MD5 2c7bdb2ddded90da13fe36e7c8b10659
SHA1 2ecf7f47b703754173411b5878a82b304a191c20
SHA512 ce562ceb9f217fb4eafd00beee8b79558a8c429ac1ebc874eee9c8fd27796f26a0ff22511c6d18e4a0d0d6abd2c99998f7126139137cff98e5c4d3a24960c8ae
TLSH
T1D8900262110C0E1F1676B18D553169941E2C146D5259046399A5918246440554587149
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3184-0-0x0000000000DE0000-0x000000000123C000-memory.dmp

Download