Overview

overview

7

Static

static

3

.48whc1q2bf9.exe

windows10-2004-x64

7

.48whc1q2bf9.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    112s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 02:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    .48whc1q2bf9.exe
  • Size 4.9MB
  • Sample260714-c2me2aey4y
  • SHA256 b7ca95d1b23c8e67416a25cedf741de0917c2096bbc9d24649eea7853d054903
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
credential_accessspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\.48whc1q2bf9.exe
    "C:\Users\Admin\AppData\Local\Temp\.48whc1q2bf9.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4240
    • C:\Users\Admin\c8d9104b7836.exe
      "C:\Users\Admin\c8d9104b7836.exe" C:\Users\Admin\AppData\Local\Temp\.48whc1q2bf9.exe
      2⤵
      • Executes dropped EXE
      PID:1112
    • C:\ProgramData\mafu\mafu.exe
      "C:\ProgramData\mafu\mafu.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3720
      • C:\Users\Admin\7b178c0fd43b.exe
        "C:\Users\Admin\7b178c0fd43b.exe" C:\ProgramData\mafu\mafu.exe
        3⤵
        • Executes dropped EXE
        PID:3148

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        mafu.exe
        • Path C:\ProgramData\mafu\mafu.exe
        • Size 4.9MB
        • SHA256 b7ca95d1b23c8e67416a25cedf741de0917c2096bbc9d24649eea7853d054903
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        c8d9104b7836.exe
        • Path C:\Users\Admin\c8d9104b7836.exe
        • Size 1.1MB
        • SHA256 a56e19d24e3b7fe0bdaf06500780ede1e80d8623c9432c63868e2d4c10fd645e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download