Overview

overview

8

Static

static

3

CaiThuVien.exe

windows10-2004-x64

8

CaiThuVien.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    51s
  • max time network
    66s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 07:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CaiThuVien.exe
  • Size 598KB
  • Sample260803-hty2radf88
  • SHA256 3fe8dc93c4e5958c4bb9d1088df70ed346d479ddb0710245a0c4ab7dcd92787b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discovery

Malware Config

Signatures

  • Downloads MZ/PE file 5 IoCs
  • Executes dropped EXE 4 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CaiThuVien.exe
    "C:\Users\Admin\AppData\Local\Temp\CaiThuVien.exe"
    1⤵
    • Downloads MZ/PE file
    • Suspicious use of WriteProcessMemory
    PID:1796
    • C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-10.0.10-win-x64.exe
      "windowsdesktop-runtime-10.0.10-win-x64.exe" /quiet /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5760
      • C:\Windows\TEMP\{AE452C92-E307-411B-944B-446E135A46A8}\.ba\wixstdba.exe
        "C:\Windows\TEMP\{AE452C92-E307-411B-944B-446E135A46A8}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{2784753E-D807-4F32-8D7A-3180637239F3} {80457974-61C8-4CAA-A2EA-FDD93031C848}
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2656
    • C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-8.0.29-win-x64.exe
      "windowsdesktop-runtime-8.0.29-win-x64.exe" /quiet /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:784
      • C:\Windows\Temp\{5E2F6E92-20E4-4D5F-AA76-FC2D8EC421B2}\.cr\windowsdesktop-runtime-8.0.29-win-x64.exe
        "C:\Windows\Temp\{5E2F6E92-20E4-4D5F-AA76-FC2D8EC421B2}\.cr\windowsdesktop-runtime-8.0.29-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-8.0.29-win-x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /quiet /norestart
        3⤵
          PID:1472
          • C:\Windows\Temp\{5DA17B03-D56B-43B2-A179-61EDE4273869}\.be\windowsdesktop-runtime-8.0.29-win-x64.exe
            "C:\Windows\Temp\{5DA17B03-D56B-43B2-A179-61EDE4273869}\.be\windowsdesktop-runtime-8.0.29-win-x64.exe" -q -burn.elevated BurnPipe.{754C81DC-EB4F-4D41-B90D-5290CC0180ED} {DAB4D8E1-2706-4A13-A76A-BF2A79C3C0D4} 1472
            4⤵
              PID:4836
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 1584
              4⤵
              • Program crash
              PID:2388
        • C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-8.0.29-win-x64.exe
          "windowsdesktop-runtime-8.0.29-win-x64.exe" /quiet /norestart
          2⤵
          • Executes dropped EXE
          PID:2036
          • C:\Windows\Temp\{37308C7B-88FA-401A-AB3A-F370B5011ED1}\.cr\windowsdesktop-runtime-8.0.29-win-x64.exe
            "C:\Windows\Temp\{37308C7B-88FA-401A-AB3A-F370B5011ED1}\.cr\windowsdesktop-runtime-8.0.29-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-8.0.29-win-x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /quiet /norestart
            3⤵
              PID:3000
              • C:\Windows\Temp\{4B361580-6006-40F1-ACF5-471100A967D9}\.be\windowsdesktop-runtime-8.0.29-win-x64.exe
                "C:\Windows\Temp\{4B361580-6006-40F1-ACF5-471100A967D9}\.be\windowsdesktop-runtime-8.0.29-win-x64.exe" -q -burn.elevated BurnPipe.{B0C4673C-8711-4797-94FE-C648F963943F} {F4891E77-7C57-4B70-B2CB-0F22DFB19115} 3000
                4⤵
                  PID:5592
            • C:\Users\Admin\AppData\Local\Temp\oalinst.exe
              "oalinst.exe"
              2⤵
                PID:2008
              • C:\Users\Admin\AppData\Local\Temp\oalinst.exe
                "oalinst.exe"
                2⤵
                  PID:3312
                • C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-8.0.29-win-x64.exe
                  "windowsdesktop-runtime-8.0.29-win-x64.exe" /quiet /norestart
                  2⤵
                    PID:1500
                    • C:\Windows\Temp\{AD47658F-0BE4-498D-8DB8-2B8D85A77490}\.cr\windowsdesktop-runtime-8.0.29-win-x64.exe
                      "C:\Windows\Temp\{AD47658F-0BE4-498D-8DB8-2B8D85A77490}\.cr\windowsdesktop-runtime-8.0.29-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-8.0.29-win-x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /quiet /norestart
                      3⤵
                        PID:1292
                        • C:\Windows\Temp\{D517D6D6-CFE8-4803-ADC1-945E623CABAC}\.be\windowsdesktop-runtime-8.0.29-win-x64.exe
                          "C:\Windows\Temp\{D517D6D6-CFE8-4803-ADC1-945E623CABAC}\.be\windowsdesktop-runtime-8.0.29-win-x64.exe" -q -burn.elevated BurnPipe.{78D46E5B-6448-45ED-96DC-6821DA53BA00} {B818EF9C-ED06-47B5-AE0E-2ABB2D054696} 1292
                          4⤵
                            PID:1436
                    • C:\Windows\system32\msiexec.exe
                      C:\Windows\system32\msiexec.exe /V
                      1⤵
                        PID:5716
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding 9DD13F167FBBB2C684938EC2083CA118
                          2⤵
                            PID:5036
                        • C:\ProgramData\Package Cache\{9f2d26b2-8ee6-4466-ae8b-0a84b0ab083e}\windowsdesktop-runtime-8.0.29-win-x64.exe
                          "C:\ProgramData\Package Cache\{9f2d26b2-8ee6-4466-ae8b-0a84b0ab083e}\windowsdesktop-runtime-8.0.29-win-x64.exe" /burn.runonce
                          1⤵
                            PID:1824
                            • C:\ProgramData\Package Cache\{9f2d26b2-8ee6-4466-ae8b-0a84b0ab083e}\windowsdesktop-runtime-8.0.29-win-x64.exe
                              "C:\ProgramData\Package Cache\{9f2d26b2-8ee6-4466-ae8b-0a84b0ab083e}\windowsdesktop-runtime-8.0.29-win-x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.29_(x64)_20260803080331.log"
                              2⤵
                                PID:456
                                • C:\ProgramData\Package Cache\{9f2d26b2-8ee6-4466-ae8b-0a84b0ab083e}\windowsdesktop-runtime-8.0.29-win-x64.exe
                                  "C:\ProgramData\Package Cache\{9f2d26b2-8ee6-4466-ae8b-0a84b0ab083e}\windowsdesktop-runtime-8.0.29-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{9f2d26b2-8ee6-4466-ae8b-0a84b0ab083e}\windowsdesktop-runtime-8.0.29-win-x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.29_(x64)_20260803080331.log"
                                  3⤵
                                    PID:5368
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1472 -ip 1472
                                1⤵
                                  PID:3708

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      state.rsm
                                      • Path C:\ProgramData\Package Cache\{9f2d26b2-8ee6-4466-ae8b-0a84b0ab083e}\state.rsm
                                      • Size 968B
                                      • SHA256 f6e905d8b563ce8f798875e72ca4c144525e3cae5a0b9ecc4f7e5a7bf5bae8ca
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      windowsdesktop-runtime-10.0.10-win-x64[1].exe
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UQC8YCF3\windowsdesktop-runtime-10.0.10-win-x64[1].exe
                                      • Size 15KB
                                      • SHA256 060d384d8ca3f9415c20bfaf7e570e4082d7727fe229f00308967ee55a9f3be1
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      windowsdesktop-runtime-8.0.29-win-x64[1].exe
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UQC8YCF3\windowsdesktop-runtime-8.0.29-win-x64[1].exe
                                      • Size 15KB
                                      • SHA256 6da40dba0d7f201ba1e0933b13b3d11f989e0400a4d970400494a8dbc0309548
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      Microsoft_Windows_Desktop_Runtime_-_8.0.29_(x64)_20260803080331_000_dotnet_runtime_8.0.29_win_x64.msi.log
                                      • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.29_(x64)_20260803080331_000_dotnet_runtime_8.0.29_win_x64.msi.log
                                      • Size 3KB
                                      • SHA256 77856c5d7b065a399bb577f1c9f11edcd07a39e0496d4d748864cc5b8642d36c
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      oalinst.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\oalinst.exe
                                      • Size 790KB
                                      • SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      MSI8EA.tmp
                                      • Path C:\Windows\Installer\MSI8EA.tmp
                                      • Size 219KB
                                      • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      BootstrapperApplicationData.xml
                                      • Path C:\Windows\TEMP\{AE452C92-E307-411B-944B-446E135A46A8}\.ba\BootstrapperApplicationData.xml
                                      • Size 9KB
                                      • SHA256 b1eda1e98d843eef81232344754cdc0973d9dda1c1790a91a352c167c9a64ca5
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      DotNetLogo_256x.png
                                      • Path C:\Windows\TEMP\{AE452C92-E307-411B-944B-446E135A46A8}\.ba\DotNetLogo_256x.png
                                      • Size 2KB
                                      • SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      dotnet.ico
                                      • Path C:\Windows\TEMP\{AE452C92-E307-411B-944B-446E135A46A8}\.ba\dotnet.ico
                                      • Size 44KB
                                      • SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      thm.wxl
                                      • Path C:\Windows\TEMP\{AE452C92-E307-411B-944B-446E135A46A8}\.ba\thm.wxl
                                      • Size 7KB
                                      • SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      thm.xml
                                      • Path C:\Windows\TEMP\{AE452C92-E307-411B-944B-446E135A46A8}\.ba\thm.xml
                                      • Size 11KB
                                      • SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      windowsdesktop-runtime-8.0.29-win-x64.exe
                                      • Path C:\Windows\Temp\{37308C7B-88FA-401A-AB3A-F370B5011ED1}\.cr\windowsdesktop-runtime-8.0.29-win-x64.exe
                                      • Size 607KB
                                      • SHA256 4c22529b90cd9d29c048790e19b7994c33e9da7f852e5af1708369b88dfacfa9
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      BootstrapperApplicationData.xml
                                      • Path C:\Windows\Temp\{42FB8DD2-144A-4E82-9C5B-A7C088BE8C69}\.ba\BootstrapperApplicationData.xml
                                      • Size 7KB
                                      • SHA256 307ea5d03393c53cd58cff0fb35319ab5b57a325d9ace786399a325e7b840a66
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      thm.xml
                                      • Path C:\Windows\Temp\{42FB8DD2-144A-4E82-9C5B-A7C088BE8C69}\.ba\thm.xml
                                      • Size 11KB
                                      • SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      thm.wxl
                                      • Path C:\Windows\Temp\{4B361580-6006-40F1-ACF5-471100A967D9}\.ba\1033\thm.wxl
                                      • Size 5KB
                                      • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      bg.png
                                      • Path C:\Windows\Temp\{4B361580-6006-40F1-ACF5-471100A967D9}\.ba\bg.png
                                      • Size 4KB
                                      • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      wixstdba.dll
                                      • Path C:\Windows\Temp\{4B361580-6006-40F1-ACF5-471100A967D9}\.ba\wixstdba.dll
                                      • Size 190KB
                                      • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      dotnet_host_8.0.29_win_x64.msi
                                      • Path C:\Windows\Temp\{5DA17B03-D56B-43B2-A179-61EDE4273869}\dotnet_host_8.0.29_win_x64.msi
                                      • Size 704KB
                                      • SHA256 3ef63fcdd91719af61f8288dfa2ee30025dd22aa44b5108a0306b0b0e298724e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      dotnet_hostfxr_8.0.29_win_x64.msi
                                      • Path C:\Windows\Temp\{5DA17B03-D56B-43B2-A179-61EDE4273869}\dotnet_hostfxr_8.0.29_win_x64.msi
                                      • Size 776KB
                                      • SHA256 2f0a87923cdb71eb4313ea5acc00f38a8470ff88f415147b9dd50187e92d528a
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      dotnet_runtime_8.0.29_win_x64.msi
                                      • Path C:\Windows\Temp\{5DA17B03-D56B-43B2-A179-61EDE4273869}\dotnet_runtime_8.0.29_win_x64.msi
                                      • Size 19.2MB
                                      • SHA256 249c240345273cb95dcf73a6005dbb646601a9c434680f381bc4de3c7f749a08
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      windowsdesktop_runtime_8.0.29_win_x64.msi
                                      • Path C:\Windows\Temp\{5DA17B03-D56B-43B2-A179-61EDE4273869}\windowsdesktop_runtime_8.0.29_win_x64.msi
                                      • Size 19.9MB
                                      • SHA256 12a91444f03fdc1bc6b10c4b64a7a236a8356e21287f13b9e347a8b35d1e93c9
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      wixstdba.exe
                                      • Path C:\Windows\Temp\{AE452C92-E307-411B-944B-446E135A46A8}\.ba\wixstdba.exe
                                      • Size 431KB
                                      • SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download