2af4b243596b313cc8a8f708af7bfa0d1e9296915f142ff28bbbcd6d17e47621

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MuMu_6.0.1_Rs3Z3RC.exe
Size 5.8MB
Sample260721-mrt28sdt2l
SHA256 2af4b243596b313cc8a8f708af7bfa0d1e9296915f142ff28bbbcd6d17e47621
MD5 ea77c3f583c02410e18a8ff2bfd92cd0
SHA1 198107cda7854ca3ad99dd8a86da9a3a3bcf9de1
SHA512 8e3d6d2bc7f5dfd8a1c0dea5556d4d933a1475c6ea3f89d4d0dd23f743415e33329a711a5b18c257039be469cbe2e3f799b0d110912f92d4294de45b5692b049
SSDEEP 98304:Uer6uFFkOuPV3cjtFYEUO9u97ZmKdlhqap1ZcWDtIELv9VCOxeI+S0bIwrSwVNJ3:Rr6uFFkOuPy7c7ZHlLbjXLWjI+SvFCj3
TLSH
T131562392D601B3B2D41E5DFC512D87B6FE933CDE6C482C46018EF1ABB0AD5612E858DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	nemu-downloader.exe

Executes dropped EXE 6 IoCs

pid	Process
244	nemu-downloader.exe
2472	crashpad_handler.exe
2356	ColaBoxChecker.exe
1292	HyperVChecker.exe
4996	HyperVChecker.exe
4808	HyperVChecker.exe

Loads dropped DLL 5 IoCs

pid	Process
244	nemu-downloader.exe
244	nemu-downloader.exe
244	nemu-downloader.exe
2472	crashpad_handler.exe
2472	crashpad_handler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nemu-downloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColaBoxChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MuMu_6.0.1_Rs3Z3RC.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
244	nemu-downloader.exe
244	nemu-downloader.exe
244	nemu-downloader.exe
244	nemu-downloader.exe
244	nemu-downloader.exe
244	nemu-downloader.exe
244	nemu-downloader.exe
244	nemu-downloader.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 244	3212	MuMu_6.0.1_Rs3Z3RC.exe	89
PID 244 wrote to memory of 2472	244	nemu-downloader.exe	90
PID 244 wrote to memory of 2356	244	nemu-downloader.exe	91
PID 244 wrote to memory of 1292	244	nemu-downloader.exe	94
PID 244 wrote to memory of 4996	244	nemu-downloader.exe	96
PID 244 wrote to memory of 4808	244	nemu-downloader.exe	98

C:\Users\Admin\AppData\Local\Temp\MuMu_6.0.1_Rs3Z3RC.exe
"C:\Users\Admin\AppData\Local\Temp\MuMu_6.0.1_Rs3Z3RC.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\nemu-downloader.exe
  C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\nemu-downloader.exe
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\crashpad_handler.exe
    C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --metrics-dir=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --url=https://sentry.netease.com:443/api/325/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=d7282c50f1b64296835edf7d19667322 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\c0d7c385-ff19-4f58-1ce1-b7166cfecdd2.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\c0d7c385-ff19-4f58-1ce1-b7166cfecdd2.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\c0d7c385-ff19-4f58-1ce1-b7166cfecdd2.run\__sentry-breadcrumb2 --initial-client-data=0x394,0x398,0x39c,0x370,0x3a0,0x75434800,0x75434818,0x75434828
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\ColaBoxChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\ColaBoxChecker.exe" checker /baseboard
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2356
- - C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:1292
- - C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:4996
- - C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ColaBoxChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\ColaBoxChecker.exe
Size 4.0MB
SHA256 65aa91ee18b46603a5543fdd398d6331a9f77eb8a16a6933f2fe576fc62d6941
MD5 a6d0d421e32946a34de15e4e397ec0b0
SHA1 bc15a70e4d1f9815cfe8d2532d447f0702bb18f0
SHA512 b7817f72fabbf2017d91d48765b2bba83f784d7e02107695f8a7584f8834a12b0a745688d3cbede795b14afe7de4007442f8c96fcc0059b2af309c1ea1493e43
SSDEEP 49152:1gP8dFBouKaau2VgFLTeJxx8IHqQOPclSWkar66Dv4TpN1KjH304dAHRvOA:WP8dFuudB0gFLQ2QOQ660TpN1eX3dC
TLSH
T1DB167D31370BC135FF8281B7456DABAB437C8A650B7340DB92D42BBAD9352E22B35D52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HyperVChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\HyperVChecker.exe
Size 118KB
SHA256 d545ed2dfc015f965d35dc4950fe773cb94103a685d3c25c4b44fcb466a85662
MD5 ba1dd89be69ee0e03af11d90785b5b00
SHA1 8d46e63b0b9635ebcf79ab46093832dc4936b800
SHA512 ca33b083b717c2cb1f40fe6eb96b52b71ede808c1d09c782d659aa7ab6034fa612326f17ad4db0b8ed9f1ae2e8633db54f89ea95536a856f338dfe3286e9d6f7
SSDEEP 3072:0wLn2WoLPivTkgxUJ8UrtmMx7bB5dSUo+WziN:Jn2WoLP++J8Upo+WM
TLSH
T193C37D57A3E434F9E17B9638C8910A49DB72B87207609FAF03A442961F637D25D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\MSVCP140.dll
Size 427KB
SHA256 8acd9e63a83f2facfc68b801f864f923eac5fb8c8a046a32fef8d622ba7d407f
MD5 77e799e61066dfb983babee530e22fd1
SHA1 659484995b44b5d6e7d22d52abbfa2f68e27d32e
SHA512 e942da491509ce781abc2ea099fea110df076d264053b92a836428fcae82e29e07351f6678aa884ec26dd12230c864d3bfbd1058ecc94c89baa0cd5dd1826744
SSDEEP 12288:+LxU+0XySH2CyKSPRBb22umby6hUgiW6QR7t5s03Ooc8dHkC2eskI4j:wxUwSH2CyKaBb22umb203Ooc8dHkC2e7
TLSH
T121943932BB460DF1E48913B971C9472193FAFC610362E3C397DAF1262F566C6A633A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\VCRUNTIME140.dll
Size 75KB
SHA256 526d8774c67248aa62a5911acd7db667cc4bed5be2cd5dc139c6c4d5dfb9d57e
MD5 dff7397268e74ff615529032a9af2ccb
SHA1 68a671e4634825684494e45d7724a64b5146b3eb
SHA512 c0928d3c0e997bcc082530ff565569267f9e307f45f796a0f62c76f66c6121674d87123af19993f2b9f40dd7f059d1ded51c29d5d11b8dc47802cc83690e6d0f
SSDEEP 1536:c6H1qvERANBw6qntn64lqVwhNDyUZXRqtnHEecbCBg6yzT:c6HMMRANK6qtnsVON7JYkecbCBQ
TLSH
T1FE739E5274C48272C5AE4AB9017AF612663DAA604FD15FDB7FD8598C9B79BC0EF30203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baseboard

Path C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\baseboard
Size 115B
SHA256 b379444e66b70b2e80cfaefe85ef2f74386f306fc8e4179cea5b6b335bda8186
MD5 b71ff363798958f2905b2940b2f93862
SHA1 8f61e82210a4dca67e5e4b0b26ba9eef4ced6b9e
SHA512 144c2bd4e1c0989665c397f5885019d59959d236d51b181befdaae3dfea00b66bb3ccc900d7feb36ce8cbf2f51037308479179c32e0c6165bf1de8fa34ecd809
TLSH
T176B0123CE1C32D07C05B4815043B549A25404C779B056C70370E157C0B8C57A6F9BACC
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\config.ini
Size 350B
SHA256 bd17cecf29c2c8d7baf01fe0513f026931049f65717fd97768c0592ebb4c4d88
MD5 b225658a45143109a32762dea6a2c53c
SHA1 484c6a847dc99b4d5929f9e05cbff735b77328dc
SHA512 9b6c8a8b1c794c66ef7143d920ea0082da55e0fc170b9ba554cf1d1eb29f65046322dba7e7edff06b98a15902ecb212af9e647bca2374ce5b531e30f6ac8a30a
TLSH
T14FE0127D6222C516B6017ECD240B3301AC3BB5F33E404090EB29E5B6B533D26D22780B
MD5 SHA1 SHA512 TLSH

Submit Download

crashpad_handler.exe

Path C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\crashpad_handler.exe
Size 542KB
SHA256 9769c585019a1a19d96dc0f378bd90240015a54ba77288b2efc995f791a49bc0
MD5 9ba1e7d7bfce0e9e0d52f33ef5e01e91
SHA1 5e301c6d74602e30ecabd1e445dc334440b2e07c
SHA512 aeb4c76a23bf8664c140035491f3747a6a39b4f118dd12177e5b0aff021d33ff7a3903af22dc37cb350e582ca94dcdc6d64cb204c11f50b2caa7acf643dae00e
SSDEEP 12288:reAQnPupDjbkEW1b4uifVysTVRAtCX/BJ2LoUG3zi8SrcOTFJMjlgPrdhfbTh0aI:reAQn2ptXX5J6Gj/SrcOTFJMjlgPrdhW
TLSH
T12CC48D707A2AC136D25291F15C59EBF790AC991A4B7308C3B3C95B396A712D32F32937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nemu-downloader.exe

Path C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\nemu-downloader.exe
Size 3.5MB
SHA256 e5b377e0fe13e27a21723dcd61fe2dcab988ea439426f6a65fb253acb205bff5
MD5 ff519fa7e3d8494dcb3f1282010b9ee8
SHA1 fdd80e1fb266ba29046a6c3e2bdc90ebab001890
SHA512 76b844efa370d6095037086bd6546cfceff5076fc793d439c29e4c7c3907530639d2e39dace93f2126cb310a3d6e66b9c8ff5577aefba4d221cfb67025213ed2
SSDEEP 98304:TiKbP5Ku3cDjEL3b/xF9y1+r0+gUzGMaS/b2IBbcrSFoR6uFFkOuPXNX:OKbPb3mgL3diOaS/b2IB0JR6uFFkOuPh
TLSH
T1D8067C01B791913AF9F305BAC9BE561E443D7E311B2880C793C45A5F2AB6DD23A31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sentry.dll

Path C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\sentry.dll
Size 223KB
SHA256 2e108ccbbd47997978512835013d06500bef5575f29cb937f623d30596662819
MD5 2c886b7927c0748042a5e294fba28e52
SHA1 8f4723d26f334f98349e237fb58e6df7791c24fe
SHA512 2667bca82d042cbb0f8d1140ee74efdd8e7d4e81881b7ecee337ea03506533055c382f176ee34ece15245584163d7ff3c796a1612cf5b38d060d6dcabe387c7a
SSDEEP 6144:BzEuxVrnhbnA4bWqkr3hRpR31HoXr4cDfSNEaFDRXtJ:BzfxVrnhbAVFVKX8SfSNEaFldJ
TLSH
T139248EA13715CE7ED79F03F4A8FB6BBB853951190B7285C3E3492F6856310C22B3661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\7z96BB7C8C\skin.zip
Size 398KB
SHA256 aa40840b724a3c1e1d2d567b7b03b077bbd813268224273511826c5bd4454c10
MD5 d5a974d94c01a270a6f3d5816d2417bf
SHA1 4afe596d9d62b539e861dc66ef963198e320d386
SHA512 9e53dccd2a240985efccb85962a76ac1a07a2260e03171cf02058e7fe362b7efaea7eb0f7860cd8b0109e9a6f60ced7ff6e211108b7ce981cfc3039e730e4d2d
SSDEEP 6144:kRsoSTx0vEyyfDRqwg/d1SQC+HxzG96e3Pi1GG1x8ZFE7gI8L:csfDLpg/d5CAD8jE7gFL
TLSH
T19A8412DFF721A08AC69FA778510700526D3E5897C531BB4A1CB248645BCFEF406AA39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download