0990b274eb623a27843d8c3f692920837d7078991674fa1630ac810d573f1187

Analysis

max time kernel
299s
max time network
190s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KomuriClient.exe
Size 171.9MB
Sample260803-pg8trayxcy
SHA256 0990b274eb623a27843d8c3f692920837d7078991674fa1630ac810d573f1187
MD5 1efa09f3908f76887391de677d025d4b
SHA1 c33badc49987b46827e5c8d25144a05873b39421
SHA512 1fb7fcdba4abb74c26412d6a5e61a16a82bedfb1d700275d6b777291cc2d6cd02eca02fb8e42512201a07134a872a7c698d98626423e0a55f10f626b79a26275
SSDEEP 1572864:rasGSAvwGc3AWWR6cN2rxlMxg3fkRPgGFDyrakAcihuSrK6yj0Jip5hMj6xCL4N:j4fc/M+i6xCL
TLSH
T1E2888C03E29A51D9E01DE1B5978B9233EE71B8454B29B2DF275407522F7BEE42B3CB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3748	javaw.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4136	4648	KomuriClient.exe	79
PID 4648 wrote to memory of 4136	4648	KomuriClient.exe	79
PID 4648 wrote to memory of 3748	4648	KomuriClient.exe	80

C:\Users\Admin\AppData\Local\Temp\KomuriClient.exe
"C:\Users\Admin\AppData\Local\Temp\KomuriClient.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\KomuriClient.exe
  "C:\Users\Admin\AppData\Local\Temp\KomuriClient.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\KomuriClient" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1692,i,2587301396758938920,7923793543369806902,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1684 /prefetch:2
  2⤵
  PID:4136
- C:\Users\Admin\AppData\Local\Temp\resources\java\jre\bin\javaw.exe
  C:\Users\Admin\AppData\Local\Temp\resources\java\jre\bin\javaw.exe --enable-native-access=ALL-UNNAMED -Djava.awt.headless=false --add-opens java.base/java.lang=ALL-UNNAMED -cp C:\Users\Admin\AppData\Local\Temp\resources\java\ff4a86e50d06.jar V ira-dadba8d6::default
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jna3834322738031689682.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna3834322738031689682.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3748-89-0x0000020359C40000-0x000002035A9E2000-memory.dmp

Download

memory/3748-92-0x0000020359C40000-0x000002035A9E2000-memory.dmp

Download

memory/3748-94-0x0000020359C40000-0x000002035A9E2000-memory.dmp

Download

memory/3748-95-0x0000020359C40000-0x000002035A9E2000-memory.dmp

Download

memory/3748-100-0x0000020359C40000-0x000002035A9E2000-memory.dmp

Download

memory/3748-107-0x0000020359C40000-0x000002035A9E2000-memory.dmp

Download

memory/3748-112-0x0000020359C40000-0x000002035A9E2000-memory.dmp

Download

memory/3748-113-0x0000020359C40000-0x000002035A9E2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads