26f95a443f43b0dfde765fd5664ee7e9921e1bd875792f06372a503bfdc67cc7

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FLiNG_Trainer_c10.exe
Size 2.6MB
Sample260719-php32adw2z
SHA256 26f95a443f43b0dfde765fd5664ee7e9921e1bd875792f06372a503bfdc67cc7
MD5 9a19118b624be06f1defc3a4e17e3930
SHA1 a67c87ed412e00f629cbf15b806d08fff22daca7
SHA512 81b96242ff8b1ad6b05e4a89d260f159b3d6bef4d9ba5966df649f7daf13ce49a9f1f4b2692e60329c6159b3bcc834cbe1b1771987e392064a55c82b1e6daf5e
SSDEEP 49152:ACSHpdWFvOzGqefoLcJmkjbWRtYy8Ztcjh7hXxpFReCjf0JUSthi/:pkONOzGqncJljEYyGtcBhhpFI9O
TLSH
T13ED511E23614CBC6E4930134D0EEFF68D9506DF916D4CA9AF15239EA99313938F5E318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3444-0-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3444-184-0x0000000000400000-0x00000000004BA000-memory.dmp	upx

Loads dropped DLL 4 IoCs

pid	Process
3444	FLiNG_Trainer_c10.exe
3444	FLiNG_Trainer_c10.exe
3444	FLiNG_Trainer_c10.exe
3444	FLiNG_Trainer_c10.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FLiNG_Trainer_c10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
416	taskkill.exe
4580	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	416	taskkill.exe
Token: SeDebugPrivilege	4580	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 416	3444	FLiNG_Trainer_c10.exe	89
PID 3444 wrote to memory of 4580	3444	FLiNG_Trainer_c10.exe	92

C:\Users\Admin\AppData\Local\Temp\FLiNG_Trainer_c10.exe
"C:\Users\Admin\AppData\Local\Temp\FLiNG_Trainer_c10.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im FLiNGTrainerUpdater.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:416
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im FLiNGTrainer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsInstall.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\nsInstall.dll
Size 5.1MB
SHA256 1a45794f2a20b18d66e652a577b0280a72e07499521ce85d502dd513910a2f64
MD5 49e4160d5808277265d3e1790e9bef3d
SHA1 27786aef31f724a2ea20dd646b485137ecfeb41e
SHA512 58245c5bdba89f93d46a7040c1c2db77a98f68c0e7a90f5b020d2c565e1fa88a7dc7254b1c33a396c95dc7eb5b02bcf54803d8f06af790e31bfe5f174b8343d1
SSDEEP 98304:iXvqDr1o/ggP+uSwbmCKtUaHiBmyRNaL68zX:iqDmCwbmCOCBmkA68
TLSH
T13346BF11FB829471E5EF01B996BF67BE8A7D9920033485C783D429B9DE305D07B3638A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

banner.png

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\uires\image\banner.png
Size 23KB
SHA256 9216297505275118bb1ff24ff4cd39b5019e94f0109a643bf43211cacff86e10
MD5 400a1bc986d2338f28b81b1952b8c0c9
SHA1 50645d53eb9330dc1553ab43ddde5b00cdf4a40d
SHA512 b02d5ef2d1c498d2c38c7423286715e16200c40083ceb4e7317910a2643d494abbc86356c8934951ade49b970d2809b434cc53b394c672eca1de1df6fa3a8c76
SSDEEP 384:EHlEUcFLG/makLAEpcBM9o0nsY/+19iMK5TjWjZgtLE5fJEZREbXKYC1w8Uw7Rgv:E7c9gSAE6t0D++D5on8AC1wTw74
TLSH
T1DFB2D0972C77F04B1A4F2E7677C5C6BBE40A356329F32789238D954F8C85EB2111254E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bkimg.png

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\uires\image\bkimg.png
Size 304KB
SHA256 c036301f55e2c8811d19e18d88dc623a3d986250df19a0b8abb94173b0e13be3
MD5 5dedf7cc75c9288c1b72caf57b6ac986
SHA1 b57ee8b261d8fa5fd9c85bcc19a5a4690aebdb13
SHA512 5b14027feabf43170ebc5e4807e3773fffab3d982bcc051e74e6e6ffd67dd5e5d7915846946e8db5316d0c174f793c800bf9d22df360efacb951e30ef586b6fb
SSDEEP 6144:5FdXvYO+egFGAh8fDJHGuSvq8dKyswydlSn6bZaB25AnLkxM7:5FNYBtgAhITWq8d8wySOaBOcYxO
TLSH
T129642371CF890D94D0E1DBE129DB95886F802613C8D82B16CEBE9917AE237B5F1B705C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

checkbox.png

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\uires\image\checkbox.png
Size 260B
SHA256 b107bb3d73f8ddd4fb2a8249de4cbde78d3ff5af402f38d12a1e436101d7cb4b
MD5 85fc9ec156ede34f7f7ad908b2bbd81d
SHA1 02fe12f5b853ad30597847050cfa8fbbd5cb4463
SHA512 0c2818624df5a595fb4d052617cdace2406b5b806f940eaa9e9547d3fbe0605053a44856c50e2a04720859f55bd14eb23e3dfe5f6960d1627b22d911896fd428
TLSH
T120D02BCA6754C97AD80C483902772D20645B519A336331161D5630989265DA166DA272
MD5 SHA1 SHA512 TLSH

Submit Download

custom#150.png

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\uires\image\custom#150.png
Size 298B
SHA256 20bafe351e8f53d3f455a8e51d8d9acf1656166d2414c5ef1027c7b52e5c20c2
MD5 122c7b3117f9b598ab3ea6a0fdc99562
SHA1 742b38b2f0ee2ba86665e8e01e60fd68a9d3fdfb
SHA512 64c51fc94b04aa2da69f87ecef534e4aab0487c8c91bf3898ba52e19b60ae8954002d46210d036c56a819d91f6abc36fd9eecb0aaa5519f7ee9bc2330821a2eb
TLSH
T16CE0E7D167066CB8DC89D973DB833C9BD8F3C195C447105D4031C4191F6030485C00F2
MD5 SHA1 SHA512 TLSH

Submit Download

custom#200.png

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\uires\image\custom#200.png
Size 513B
SHA256 6e8d99766f3cdf3bd3e750cc174a33b875db32d62e2728193439242220bf8378
MD5 7a482bc59ef7d4b96891cbe446cc8955
SHA1 a1234bba827dcaca8182fe25935fcd45d5eb4546
SHA512 fc209319b3a1e2733dd817f5752eb2717b1ac9f0de532c511a9dc6386265b21c49d3fdb943da27f890092c4535d16d239a7cd90bacc9c75a3a65562e0db792b4
TLSH
T1EBF0CC3D0752C0E14597399701B7C91937DCCD30D5B820822C6E7CD162A7E01B3C15E7
MD5 SHA1 SHA512 TLSH

Submit Download

custom.png

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\uires\image\custom.png
Size 231B
SHA256 547b6eab7805ce5807e9a3b14d1a1830bf0bc21c4e77d2e63cbe42a6d81aaa83
MD5 4d3a611f0ed95bff868ae6da0746069e
SHA1 82a5477b56b0c4b83f2352634e3c30bbc07cf68e
SHA512 91b3c3b582d3c6e96721fa17082046647f7ef88f4ebddcc4a6a70ced177feed7e0aa41f6c14799bf87e6f08a5339723491e1ad10127c684969a783258134f232
TLSH
T156D0A767F3952C3DE58E8627422851C1DA6042892290EA09696B087C296998D84646FA
MD5 SHA1 SHA512 TLSH

Submit Download

ic_install_failure#150.png

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\uires\image\ic_install_failure#150.png
Size 2KB
SHA256 b5935d78a758157f140ce90262276684061242e4d710f430f97fc0748f850562
MD5 52fb129f7de77b3a561ae3edc2ed4736
SHA1 14b28b3481ecbcb1d8419ab8947c17366af69bbe
SHA512 b947c5a70ca7a4a2d5887e7426549241f379df77c13a9a3ae18d10749a3ab050666d4c23efeb21aca487efa364ebf5c5e2229e6aac91306e6fb4b1d82ab8a273
TLSH
T11A512B26D6776D75ABCD3760BF146E08A03549B8B5D506D753ACC29EC255382398C820
MD5 SHA1 SHA512 TLSH

Submit Download

ic_install_failure#200.png

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\uires\image\ic_install_failure#200.png
Size 4KB
SHA256 be5af0600da787071492ef32f20c6be64d6e22ec617ba31dfd1806bb748d82f0
MD5 ee10d3a2c61fbf8b65d747be7703b903
SHA1 68535bea2bca4ad9e6d8aadcb249d4769cb0cf9a
SHA512 623080aaef9fb9e4185916e99795de05b1f94ae5c4ae2720b09709a1a8a0d03e121a2d84a8a73f476ca725041147d87116fc0cbfd7d078920ecaaec59fb178c1
SSDEEP 96:FFmGg7cRmHgLrEpiXkPcp6tjOGZNtUXJniHUnG1Vmy6UkG1:mGgIaMqihp65d6YUG1Bf
TLSH
T1F5815C48A8061F5BA18A29D67A4E5CD94EDB060E83FD8E2B10DDAE3A39A15142D363C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ic_install_failure.png

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\uires\image\ic_install_failure.png
Size 1KB
SHA256 5f9c674beef425ebd99bb3e5a711289533e994a32313339999808b9e0cb0ffa5
MD5 c4d5b55eaac69ca515f8e3a3feef224c
SHA1 2701976595daa66179a7649077f305b69f8c9a5f
SHA512 0e167fdf61dcf5e5926613f22b3a961d21397b6f0863f33acc9f68bc9cce1c52daeec2b6c552e19383cc2c3d6bd5d945eee49053e1b0d783c6a70bb8f254e5c3
TLSH
T1FF312DD3A2910DABF1CC452A52E812399F5D71C53D071338EA99855FD733C648C493E1
MD5 SHA1 SHA512 TLSH

Submit Download

img_waiting.png

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\uires\image\img_waiting.png
Size 15KB
SHA256 be1241ea31b09518052efa152cafd35b85e19276dba0ae28245de27b9a0f6ec6
MD5 b20fd24fc48e8612dd8d0e0c67abef70
SHA1 9f7d4da26dfa2e82fccd4dde6454e69c8f188505
SHA512 9772dad53f663db6b6127d1a54a213de123650f9841fb03e1180c0870f53ef2a8bd4ece624be76e87ae0938e8e97db469ffcb3a5e949b04650f30b563e730dc6
SSDEEP 192:WLltxpSs1KnzVWcxDN6WdFJ14u9OwOsIpkNWFU1wUATMUx+f+FNRWRXSxdwGT589:WnxExDdtvWLFU1eswRWR8kYc79
TLSH
T1C062CFAB09A3E5AE327B5C3B516533532D29C6740832754DA1CBD168B9B2E42850687F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pathpg.png

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\uires\image\pathpg.png
Size 657B
SHA256 5d9c9872a8dd4d55b13265455e8a44d5533cd61def040e9854a331c7e518de6b
MD5 ee80b122a7a78df61522784d006d6d1e
SHA1 55e89c2e827ee5452c811b3245c0886526533b20
SHA512 82a767dccdb07a2514d3a4918e06f80cd83963e5075d82fdd7536097446825b97baa60280f2061c25fc8f037d9310ce1835024dbcbf09c8f44ecaf6ad3174934
TLSH
T1F0012851634862ADF40D755F4742A713C97F17F75237682D66BFC0B1176D4858680EC1
MD5 SHA1 SHA512 TLSH

Submit Download

prog_bar.png

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\uires\image\prog_bar.png
Size 361B
SHA256 3f40dd9c0f9f537af89e586fe5ab444ee31363b16dc3e550ba2b6c0c66987ad8
MD5 a5e7cc907076a0faedd58c07be9b51d4
SHA1 b5cb775d8f84504c8bc1b277f3c805092615dbe1
SHA512 f3ab080ac32de9a3e8d036984b921d6f173e8e2436abbdefe030a90dbbff8ebaa6174ec384e37b7ec9698883af979e4aefb97cc58fb0980cd2131a5bb1dc9a99
TLSH
T1F6E07DD2F8888D29D22D87BDD1E70748D43F75E59042B57F5E04C1305DA1070DC39282
MD5 SHA1 SHA512 TLSH

Submit Download

prog_bkgnd.png

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\uires\image\prog_bkgnd.png
Size 131B
SHA256 d210f0afcfca471087756355e5aaae701943adaeae9ed015e2f78e6e648cff66
MD5 c9e1012bf8d1d32358bfe5a9333a66b1
SHA1 7b6db6e759f7806bc67e76844189dddeb4c2e39e
SHA512 c524c9f5e0ed43ed6ee20ce92909948f2cfe044038f4affde6e020c8c0cf928013c9cf84303ea6eac96178cc9422366a7470c44c87b1a22a6d317faddd162620
TLSH
T19EC02BE3CA405C6CEA4D1436111F0110902B1DEB0410980C2C24E41804A84E80A81203
MD5 SHA1 SHA512 TLSH

Submit Download

scroll.png

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\uires\image\scroll.png
Size 1KB
SHA256 1db068065aa68b60a4c48ff06eff0231db074a5efa3f905daff7cf7108ca4a68
MD5 290b7010558cd82f957a98614c9e0097
SHA1 f90fa0fde9b804f105d2ac2557c8586b570bf1ef
SHA512 6fdba4c37cd4ecee91fe45b80c3c19ae58e830f3a0fc0153b6575ab66dfcad87bbb0825113b5e9b90e3f5c90a3a3f3f026dae8e7c364c9dbd1c4e9313770e4d9
TLSH
T1C331D70EFA513801B44DAA0028EC0C22CE394CC0DE94A5296849C4AA17B47FC90A59D7
MD5 SHA1 SHA512 TLSH

Submit Download

selpath.png

Path C:\Users\Admin\AppData\Local\Temp\nsf1D72.tmp\uires\image\selpath.png
Size 572B
SHA256 3d8a0ed1b0238d7d5498efae9cb1529cb608f05605de8d0a2d46bdab0d46e273
MD5 c072455093bca8c20c230e6339a43cc1
SHA1 9197abdee2f4666e996023a7a7a5ac9827122cfd
SHA512 ccb038a91000a06ee37b2d508092777e50e57c7f39ed8606fbf41e504a203a9e57f97da19c34aeb0498ce9a149ea966ede3e4f9aef8df03a9be60694b06c2324
TLSH
T1A1F041D219A9E83E4A87E02D5A0B0462402A8BFB365B371879B9051A92258DE8963042
MD5 SHA1 SHA512 TLSH

Submit Download

log.data

Path C:\Users\Admin\AppData\Roaming\FLiNGTrainer\log.data
Size 1KB
SHA256 d0f8940e133878b393c38693db7917b2fd647594b71e61b205bb2b3c1e27e672
MD5 e921d38f62657f3b406d6df57fa25669
SHA1 5dedd8784b3aa56f8db2e2174f1e41c8bd1d1d73
SHA512 7a63e69c4bd9e158590e01d9870541513d98954ba117f5d6c63abbd11f1e88de00f6dd2113d9d69f134d44b4f857e8359cb2d97b377b268c11e4234ae9b4eeee
TLSH
T18F3108AF4F6F1A77D28E3A9730C327CEAD5BC523019CD490126852BA42E290D170E7B7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3444-0-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3444-145-0x0000000003F80000-0x0000000003F90000-memory.dmp

Download

memory/3444-184-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/3444-186-0x0000000003F80000-0x0000000003F90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads