Analysis
- max time kernel
148s - max time network
41s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 12:16
Behavioral task
behavioral1
Sample
abuiabblgaag5abkhwyo6snk2wm.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target abuiabblgaag5abkhwyo6snk2wm.exe
- Size 4.1MB
- Sample260718-pfx1vsbs7p
- SHA256 42cb23f5721c4cb1756109e50254b13b7a104113d8f3e2c16dc005b1751f9cf6
- MD5 4d1f15512bcdbdf031cc2f50cc0582de
- SHA1 14cd24798c91dead533af28de18411a8129edc8a
- SHA512 9c747d5e342608524cba79940730029d46076552a9833a72ef614daeb5fe6760967f604d53251432326e4dfe5c6a81951285b84a374bdaa2263cb12fe9c29523
- SSDEEP 98304:O37Cu7IgZ0hSG/HG+Pm1LJENftfvYzy8xLN1N:O7FUDvL+1Lmt9Y1n
- TLSH T17C1633A0BBA2A55CD0F5383D199386B47FFB4E414EE2A89089D27D144376686FF47C0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4932 SunloginClient.exe - AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4296-5-0x0000000000CB0000-0x000000000150F000-memory.dmp autoit_exe behavioral2/memory/4296-27-0x0000000000CB0000-0x000000000150F000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/4296-0-0x0000000000CB0000-0x000000000150F000-memory.dmp upx behavioral2/memory/4296-5-0x0000000000CB0000-0x000000000150F000-memory.dmp upx behavioral2/files/0x000d00000001c514-11.dat upx behavioral2/memory/4932-12-0x0000000000400000-0x00000000010CB000-memory.dmp upx behavioral2/memory/4932-26-0x0000000000400000-0x00000000010CB000-memory.dmp upx behavioral2/memory/4296-27-0x0000000000CB0000-0x000000000150F000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SunloginClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language abuiabblgaag5abkhwyo6snk2wm.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SunloginClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SunloginClient.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ abuiabblgaag5abkhwyo6snk2wm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ abuiabblgaag5abkhwyo6snk2wm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ abuiabblgaag5abkhwyo6snk2wm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ abuiabblgaag5abkhwyo6snk2wm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ abuiabblgaag5abkhwyo6snk2wm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ abuiabblgaag5abkhwyo6snk2wm.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe 4296 abuiabblgaag5abkhwyo6snk2wm.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4296 abuiabblgaag5abkhwyo6snk2wm.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe 4932 SunloginClient.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4296 wrote to memory of 4932 4296 abuiabblgaag5abkhwyo6snk2wm.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\abuiabblgaag5abkhwyo6snk2wm.exe"C:\Users\Admin\AppData\Local\Temp\abuiabblgaag5abkhwyo6snk2wm.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\Temp\SunloginClient_v9.1.0.53088\SunloginClient.exeC:\Windows\Temp\SunloginClient_v9.1.0.53088\SunloginClient.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4932
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:780
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Oray\SunloginClient\config.ini
- Size 183B
- SHA256 98d0990e333da25484102d1b6b56d9a5122da8adb4a2e7607db4eb1bbe8a1afd
- MD5 461888906c4f8e4a3d14ca2dca1d3530
- SHA1 56643e9b9b30b903727f45b6dd29656d78a1c461
- SHA512 f184e244dca86deb2f9f73403efe3832d2200814a5ae1197b4cc12cd6c7d240d5537b05c5efcb51596bd5aac9231f6ec11768d534bc608007790d41f9c33be08
- TLSH T106C08068A5A250CE08B46CA477312554F3C8590C07D0D255734C41544D8FB48BE1D43D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Oray\SunloginClient\config.ini
- Size 216B
- SHA256 621703e45b4541115b8b3c76dac17c12f46fe3bc79ece112956f11ace35c6dfa
- MD5 618f5f529ad3dc8f17f3d26d8e96f8bd
- SHA1 2c99234f99a846a6fac8e0f4236a3b7f2e783312
- SHA512 8fecd48e0c1f8529f61bd84809b24645b6ed253eefa620d0b7050934773d72b3de709cb367ee7c09997eaa0659a885d6cd29de4e39ee036d95c7356250c652a0
- TLSH T148D0222CA6A344CE09B06CA067322954F3C8490C8B90D201B36C83A40C8FE08BF1D02D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\SunloginClient_v9.1.0.53088\SunloginClient.exe
- Size 3.7MB
- SHA256 47865e5992d488a6a7d14f5fb2b57cc14a2fd5f06f8c9bb5adeeb3e458c37d34
- MD5 2fe60ffe6d85565003a3e2186b1cda34
- SHA1 f18ae70f16889d0c016fdd8c6f767241e2ee2232
- SHA512 1e49c49781b437134c1d11212c036030c597ff54cc9b760188179d21c92cc13177c9db5c25ba481077c3467c29aeea904019bfab5970130bbf47e1a9071464de
- SSDEEP 98304:Bj+Jh3429G+3rJW6rGlVwUQul36d28TaVc6Y4zhBzdVCpT9:0JhN9d86rGQUQ+s28Kq
- TLSH T187062340EB950552E21F347CB516673A43CBEE48C8F496424624BE6E303EEF2A73D967
- MD5 SHA1 SHA512 SSDEEP TLSH