Overview

overview

7

Static

static

3

farware.exe

windows10-2004-x64

7

farware.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    49s
  • max time network
    50s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/07/2026, 19:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    farware.exe
  • Size 2.8MB
  • Sample260722-xpjtlafm71
  • SHA256 b64906b980784d47865532b8f18775d92b9395b1bf96239cb432ed1def3a57e2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 47 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\farware.exe
    "C:\Users\Admin\AppData\Local\Temp\farware.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1524
    • C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\tgcpww6ewn83.exe
      "C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\tgcpww6ewn83.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4692

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Application.deps.json
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\Application.deps.json
        • Size 35KB
        • SHA256 ddc6866fab0e4a9308e7dc3422e1e646581088b5371cab393672866f119d9cf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Application.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\Application.dll
        • Size 2.7MB
        • SHA256 3a3c4592ad43a66f24c816a1cbd9d97e18c44f36c4b50a74ccd12701efd6036b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Application.runtimeconfig.json
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\Application.runtimeconfig.json
        • Size 439B
        • SHA256 09c3537cf69db3d8c4c34480109bfd1716664d50371f95502b95a266729bf592
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DirectWriteForwarder.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\DirectWriteForwarder.dll
        • Size 490KB
        • SHA256 2a623687def6a72c7062dab2883725b897523b30619602e1c9f9fa6a866c7f5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Win32.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\Microsoft.Win32.Primitives.dll
        • Size 15KB
        • SHA256 50e52f74a18cf64efd7e3635c4489264a39207b221c69180999371c5597d899b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Win32.Registry.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\Microsoft.Win32.Registry.dll
        • Size 118KB
        • SHA256 fa268218302f35a460d30f0480323428a95bf67bcb957ba8cd757a6593a1586b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PresentationCore.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\PresentationCore.dll
        • Size 8.1MB
        • SHA256 06c11c41bdd66a71889ab3c8046f18e8145e52661e6823bd1fa692b47ea6c930
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PresentationFramework.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\PresentationFramework.dll
        • Size 15.4MB
        • SHA256 b6ca27c827f500396613c6ba3306bef369cc5bb4c2b9094112c1f44fb3e75854
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.NonGeneric.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Collections.NonGeneric.dll
        • Size 102KB
        • SHA256 8a4845d14b6c46234a34b4ff1fa9ee0eb157339928b58e708212daca68048294
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Specialized.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Collections.Specialized.dll
        • Size 102KB
        • SHA256 b96fd8a86a0105ff787075a10d2ab58c72ba01d02dc0d31dae582cbd78d3aee0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Collections.dll
        • Size 254KB
        • SHA256 43f1812c74be62e65bb6e232d2a61a24f1ad732d014ed5adc6fe1f13e454de8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.ComponentModel.Primitives.dll
        • Size 78KB
        • SHA256 719473d4afdabd721abe970b1f2bf20e40f3e447da6d0b784a579badb82b5a50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.Debug.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Diagnostics.Debug.dll
        • Size 15KB
        • SHA256 71fa39187aed0e29a98a0c7ac1c344cbb4d6fe7bbb8a7830a7673e181dc37778
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.DiagnosticSource.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Diagnostics.DiagnosticSource.dll
        • Size 406KB
        • SHA256 269b3a1dba411fbcd44c647ccfba184c3fa9ae01bada673ddf7e70ebc60728ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.Tracing.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Diagnostics.Tracing.dll
        • Size 16KB
        • SHA256 57aa3cd37e582f4f3080a53a5ad99fde95d0aba6edd8d7fafd73017552349676
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.IO.Packaging.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.IO.Packaging.dll
        • Size 286KB
        • SHA256 e84e52280a1c76ae6f84bfe263ab620193924df4bce73cde1a2701e2854034ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.Http.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Net.Http.dll
        • Size 1.7MB
        • SHA256 7f95d4356ec6c5f909ab2cf1f2c29d3c279c1f0a1a97b40fb5cccfdf39972ebf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Net.Primitives.dll
        • Size 226KB
        • SHA256 7e6667e15d7400a02659474e1e8b795377b89057c9ffe1c41ab3df9de94626b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.Security.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Net.Security.dll
        • Size 654KB
        • SHA256 5e5f39bd0ddb55528764bfbe03cf2f9a0632d4d9fb313dee064fbf893c5ae98a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Private.CoreLib.dll
        • Size 12.6MB
        • SHA256 09c5898352069d4971591723371be70537bea18503c2bf7c6b9dd11f74760382
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Uri.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Private.Uri.dll
        • Size 254KB
        • SHA256 b762dfa0e052d5fd9fd05309b4ae9e03d6ae46f262b620cfaad961a6070ef7fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.CompilerServices.VisualC.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Runtime.CompilerServices.VisualC.dll
        • Size 30KB
        • SHA256 4f0b694621b954307243f61a176938ee78ad46ce45d00d6e43331aefc1b54de0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.Extensions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Runtime.Extensions.dll
        • Size 17KB
        • SHA256 7211259add4a0a9b0ad045ec5c4b22c8e8a6ce04d66de63952b7899d28a9774a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.InteropServices.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Runtime.InteropServices.dll
        • Size 94KB
        • SHA256 7c53e031183b36fe378205ac894b1ddc41bca992393b153c7e68b951dc14f657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Runtime.dll
        • Size 42KB
        • SHA256 55242c750d5817ab526ab17be00a604d88458c49001eb520c0538194a9a46f26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Cryptography.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Security.Cryptography.dll
        • Size 2.0MB
        • SHA256 2d87acc3aa3f516d13562f163651c0efbacf8542b9a72389e69b5ecd124ffefc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Text.Json.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Text.Json.dll
        • Size 1.4MB
        • SHA256 61dd1e919e85962de35fc839f45651d3f22809ffac193c9bc2d71ac58347d31d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Threading.dll
        • Size 82KB
        • SHA256 72e11fd27c4e00cf5f1b78d009bc782d4d594a9d149f9c455c067f0be7f38f4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Xaml.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\System.Xaml.dll
        • Size 1.4MB
        • SHA256 c40a366b6715bde1054927c27e65114c976dd3832a75a6b34fe3cbf4a18220af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WindowsBase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\WindowsBase.dll
        • Size 2.2MB
        • SHA256 34f54062cddf13a353981136e831250838b07bfb83fb13153ed31ea1fd56d51b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        clrjit.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\clrjit.dll
        • Size 1.7MB
        • SHA256 4058cbcf9ce69938e29e6ab8bdcbcd75266fde7aad5c016394e0bde0ba690441
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        coreclr.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\coreclr.dll
        • Size 4.8MB
        • SHA256 bdcf2dabaaf30e293a59ecdada775cb9bc052b75c08147e19ea2fa82a348499a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hostfxr.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\hostfxr.dll
        • Size 358KB
        • SHA256 6030fa4943ff98b4d29787c1b3045a98d4fd03dd644a3de223f0aac2ed984b3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hostpolicy.dll
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\hostpolicy.dll
        • Size 397KB
        • SHA256 d6fd9ce40c9e2ff31f552313773b8c870249fe8e5f0140808a2bd26a238afcb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tgcpww6ewn83.exe
        • Path C:\Users\Admin\AppData\Local\Temp\tgcpww6ewn83\tgcpww6ewn83.exe
        • Size 148KB
        • SHA256 15ba8dab7e16ba3632aadaa6c0db40caca32e31e37f3bb34f958daceb8af3fa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1524-5-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp
        Download

        memory/1524-0-0x00007FFBDB51F000-0x00007FFBDB520000-memory.dmp
        Download

        memory/1524-7-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp
        Download

        memory/1524-6-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp
        Download

        memory/1524-4-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp
        Download

        memory/1524-9-0x000002389F040000-0x000002389F052000-memory.dmp
        Download

        memory/1524-744-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp
        Download

        memory/1524-3-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp
        Download

        memory/1524-2-0x000002389EFC0000-0x000002389EFCA000-memory.dmp
        Download

        memory/1524-1-0x000002389D0B0000-0x000002389D38C000-memory.dmp
        Download

        memory/1524-745-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp
        Download

        memory/1524-818-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp
        Download

        memory/1524-1016-0x00007FFBDB390000-0x00007FFBDBD34000-memory.dmp
        Download