Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 11:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
piaoju06.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target piaoju06.exe
- Size 3.8MB
- Sample260723-m9karacc27
- SHA256 22765122cc2f0ab780ce5b4e8780a94c823238807f02f89976e671230b619c90
- MD5 b7ab4f02c46b489f8d16e049c7db268c
- SHA1 d528136762c627a4595ecaeec9b8f6425c8f1996
- SHA512 dd06b604b88d614521559bc0a9f22e94a15b63ca806e85750b49db519f05540554f6b7584b70690c154cc3975d8a2150d27b4c9d9da2d6958f11ba2c0a8af970
- SSDEEP 98304:A72Aa9n03jT1YDuzOgeNlJT5oj9ghi1RebM390bYVPotHG5aoK3SHoQ:+nTg5ojD390bYVPotHGMoK3+
- TLSH T1FC06C0713E8D507EC1522172CE8AA3BDE2ABAD707E75464725503F3ABA30742592C73B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4808 RproK.exe -
resource yara_rule behavioral2/files/0x000c00000001c5a8-7.dat upx behavioral2/memory/4808-11-0x0000000000400000-0x0000000000558000-memory.dmp upx behavioral2/memory/4808-52-0x0000000000400000-0x0000000000558000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1044 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language piaoju06.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RproK.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ RproK.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ RproK.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ RproK.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ RproK.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4924 piaoju06.exe 4924 piaoju06.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe 4808 RproK.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4924 piaoju06.exe 4924 piaoju06.exe 4924 piaoju06.exe 4924 piaoju06.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4924 piaoju06.exe 4924 piaoju06.exe 4808 RproK.exe 4808 RproK.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4924 wrote to memory of 4808 4924 piaoju06.exe 89 PID 4808 wrote to memory of 1044 4808 RproK.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\piaoju06.exe"C:\Users\Admin\AppData\Local\Temp\piaoju06.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Public\Pictures\RproK.exe"C:\Users\Public\Pictures\RproK.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\cmd.execmd /c echo.>c:\xxxx.ini3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe1⤵PID:956
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_ir_tu2_temp_0\IRIMG2.JPG
- Size 36KB
- SHA256 6a9368cdd7b3ff9b590e206c3536569bc45c338966d0059784959f73fe6281e0
- MD5 f6bf82a293b69aa5b47d4e2de305d45a
- SHA1 4948716616d4bbe68be2b4c5bf95350402d3f96f
- SHA512 edf0f3ee60a620cf886184c1014f38d0505aac9e3703d61d7074cfb27d6922f80e570d1a3891593606a09f1296a88c8770445761c11c390a99a5341ee56478aa
- SSDEEP 768:S0jPDrkTYU5n10PIUcLbnkC59fNaeocQXiWN6hhm4gj0mVWQySgA1:RvqYe0PINLkC5Haeoik6HMHWQySgg
- TLSH T160F2F1822A132C76E49743F089FA4CA82A0D7E5A736F3078455DEC9FF1F8B4635456CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_ir_tu2_temp_0\IRIMG3.JPG
- Size 6KB
- SHA256 cfd9677e1c0e10b1507f520c4ecd40f68db78154c0d4e6563403d540f3bf829f
- MD5 e39405e85e09f64ccde0f59392317dd3
- SHA1 9c76db4b3d8c7972e7995ecfb1e3c47ee94fd14b
- SHA512 6733f330145b48d23c023c664090f4f240e9bbeb8368b486c8ee8682ec6a930b73275e24075648d1aa7e01db1ec7b7e259286917a006ba9af8fb7cba3439070a
- SSDEEP 192:EqK9OIJV7hREPQEOPdivlu54UovmNqg0aB0kOI:EJIIJVcPQEOEvMJoON/0aBwI
- TLSH T1E3E19E74BA172AECAE94641385254D78415B8B8393C71B951237C785C13BE77CF3147D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Pictures\Edge.jpg
- Size 358KB
- SHA256 223c11609b372f2ccdf31141ad57697e55559fc193f5bba9216f2da6c4a5da0f
- MD5 b912a845740113c09382e5bdb264afd8
- SHA1 5cc8960d4df571b22e732a2c98492b3fe51cca7f
- SHA512 f3e6f9ac6d25d6ec694d85802f404148dcec907378e6473f85b2489f6ef955a5daaa1947be40fe3ae12519729831cc85c2aad440ac540de7e0962fbd36c87222
- SSDEEP 6144:t+ACk/u6n9aBOmmD1oQFu0oOOxKnJPWyD9Dcqt1oFsxzqW7mb6:w8u69CghoQxoOTFQqtKFY77mb6
- TLSH T14274F168E6655EAE8E175FFCE04F18AE964FD9E302C900262BF1C6D1CA106F4841FD5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Pictures\RproK.dat
- Size 132KB
- SHA256 7cacb51c2b4fcb91f338b1a45a967c67cdbe192c4dbaad96add64465d6387df1
- MD5 51e54b5893284bc8122af9f0996ee573
- SHA1 7339ccc4aa74183b51bca19278e611a38110c307
- SHA512 fc3bc4a95cab7a7da894ffe8c59bb56cd68b18aafef6d2d8312c2d745088fb52b101c75b75687b15275d5891fb7af54183032883cdd925681934c1d625c4a071
- SSDEEP 3072:KV5ghImOLzHHcTzmK80URMQ+D3ityYiuEB753xI:KV5o8LHcd8bMdD3iwuy75q
- TLSH T11DD312B7C92342B4D1B924B65389DB88375B492D22EC647FA93FC310C19BBF19570C95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Pictures\RproK.exe
- Size 529KB
- SHA256 207d856a56e97f2fdab243742f0cfcd1ba8b5814dc65b3798e54d022ce719661
- MD5 49d595ab380b7c7a4cd6916eeb4dfe6f
- SHA1 b84649fce92cc0e7a4d25599cc15ffaf312edc0b
- SHA512 d00ed0d9baae96ccbaf1262b4a4aaf4468e4ace6cebcea81e74d830bf414d9bc61068b8fb0eefa742add14aec47284f3adc11be26c8b8d66bfae4c498f2a4110
- SSDEEP 12288:INrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVj7D1:IthTiP+ffCfB5Lf0F7Z1E7D1
- TLSH T166B41222B395B5ABE93F103605948C6C07F77D01B07483873854FD797EF3282AE6A948
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Pictures\edge.xml
- Size 53KB
- SHA256 edf575a66fa51fcee814d4f5e565c5cea39890354cad23b3e60f40d3e571f357
- MD5 d569577d8247791b3d861b220a01e8d5
- SHA1 e6c0082fefa6da45df90cec88f28e04c2252e82e
- SHA512 b371749a47ed499e078a179fa29dd952cd3ff9eb92a06c4b249801e21d0db0892f0a0e77584debe307d85017ca89143a87f4d2f2ee15cfa7995460a7ba634fea
- SSDEEP 768:CmFXyo4dRmYWUFyo1cAjMlp0CVdCvp6VZMfDTkmcrR+KeJ+5lMa:CWyhdR1cAj5CVdCPbTkLxZ5l9
- TLSH T11F336C10B550C0B3C5AA63386456D7329E6F691117E5D4C77FBE0BAE4F223E0E63A34A
- MD5 SHA1 SHA512 SSDEEP TLSH