9868381ad9859763dd85efff51f7f19990e57f77b183a4d6b131e451c3e33985

Analysis

user interaction
yes
max time kernel
299s
platform
windows11-21h2_x64
resource
win11-20260513-es
resource tags

arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FNAF4 Game.exe
Size 444.8MB
Sample260809-glknqa1hnd
SHA256 9868381ad9859763dd85efff51f7f19990e57f77b183a4d6b131e451c3e33985
MD5 280356aed3f11bbf739eaec48bb03ef4
SHA1 7cb32668f9c6cdf0c2b67a2830e01fe3b7a591ab
SHA512 413fb40f804d91fc2c8c149a8df47152e8b7925f5c39101884c0e15400c54eff5074eed355498d0e80a23c3c668dd2ff7556dbbb3908c57660995fa4a422b9ef
SSDEEP 12582912:NNP4AWpzVMs+IAku/y86xOpCV5YkC+auFZgnHTSeJa00ZJ1D3Mz8AC++yeqz4ko2:N57OVMNIAkWy8cF5YkC/uFf100ZJ1D8B
TLSH
T14A293342B604F10AD58941B705957F71B64C58A8631B30D3B2A8BFDB3247AF61F7BE82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
4644	FNAF4 Game.exe
4644	FNAF4 Game.exe
4644	FNAF4 Game.exe
4644	FNAF4 Game.exe
4644	FNAF4 Game.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FNAF4 Game.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4644	FNAF4 Game.exe

C:\Users\Admin\AppData\Local\Temp\FNAF4 Game.exe
"C:\Users\Admin\AppData\Local\Temp\FNAF4 Game.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cctrans.dll

Path C:\Users\Admin\AppData\Local\Temp\mrtB13A.tmp\cctrans.dll
Size 64KB
SHA256 cba1c0fa69bc6b106408d06878390a5699cd2b25adfed1a2610ee01ae2524cbe
MD5 a20165b7e7dfee46a59e48c175523af0
SHA1 6ed627806753d11e1a121689369668294d15be74
SHA512 a9295b814fe77aa4ba4dec5cbed790858852f775799fe9da01bf07d67fa294d4ca1c5a68c9255c3fb716d0dbeb8b5a5ea38b8ec72263f40957beafe7bf323cd4
SSDEEP 768:r6tSW9fPqprrtBNZZzLRkmlWNZ5jD2DpzyAcRnBQDjTpNR7:r6N9fPqp3tBNrHRkmlWNZ1oxcRcjTzt
TLSH
T131531A11B36448F0DB8E17363CAEF772157EBBA92BC4BB875D19F2ACC421160592531B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcini.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrtB13A.tmp\kcini.mfx
Size 28KB
SHA256 82c4f5af3c25a8daf60185833d3d61f2e8e2851ad640b59af54060eab6bc859e
MD5 5522465eba7c81f1fb67d6ad1a5df233
SHA1 0ec415bfaa9db6984cf922d5503d9fde67d0b3e2
SHA512 30d0ed91bf072e7b7367a708eb6a7d92cc0f326249ffdd44a0d94c3b8feb37b38387141c88add61a578393a186e9fb379d42ab0018aa14e917705e4344233f6a
SSDEEP 192:/sW5a6v2LSDS2F5BCI1Ml/GJpjz9vQx7wiWVgRQ:FuLoSwPyl/GJp94lGVy
TLSH
T1CBD219137774A831D51B5DB9483F053B7E39DE93D57AEE138120E0582812742A83BB77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmfs2.dll

Path C:\Users\Admin\AppData\Local\Temp\mrtB13A.tmp\mmfs2.dll
Size 459KB
SHA256 c0d56cefb509e5600ac6b430adcaf53b81881d3fff4e62b7ede158d66d826622
MD5 4cf7bb74d8104280b7e986f4df21109d
SHA1 edc21a43136afddbf4786593e84b934d40591b74
SHA512 2bbac48354657659795697e67508d777ee595348e1fb3d4b6c65d8618c346b3be0052b1e2e2fe669dcca19c3c00d59d1833acc21d88a97efbde2694935e3c292
SSDEEP 12288:1F4DiwTv/cRLT6BDhdI+2KPYpzGYxv1g5IQurTUckeEqvI:1F4DiwTv/I8ESAzhxvJrT1kr
TLSH
T191A4AE11F982D232E9BA12728ABCBE6A247D7A71473445E397844DBD2D701D31F327A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

waveflt.sft

Path C:\Users\Admin\AppData\Local\Temp\mrtB13A.tmp\waveflt.sft
Size 8KB
SHA256 41136b09b033a20b9acc430620ea095ff76afbdc7aebe7f26f7d2b4315afddef
MD5 f76739536860a0bdb4a7e3bbb0c06d08
SHA1 b21581aa36eda87db8845caf58c668749e26b29f
SHA512 6e65f23a4c1e3b0068b190f9aaaedcfa0466b0185cd6bbafa5f6f6940c8bc332e7c8c611d1b3b63bb2c5fcda48bbe2a678d81a3819940ecc0c701d6fec4194c7
SSDEEP 96:v2or1Jnr+4O1tLj+Ct2KTOGTrgHchhAfETVdnPstJgxl8V6B/8cKH+ewp:vp6Dj9t2ubTVdGJgOMGvw
TLSH
T181F11C12A7A500F5F8DD0B7134B7627BE875FA295725C14FC544DE6C0C302E2D928BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fn4

Path C:\Users\Admin\AppData\Roaming\MMFApplications\fn4
Size 15B
SHA256 b2a9897eb07fd35b2c5b9d2adf1864f476d55171cbdf895a4818c41b508c8442
MD5 d68cf3d262f0a667c37b6bbb417d8721
SHA1 1fd83fff6a059d4fd6b035f5ffdd0b944afc9fed
SHA512 4f314fdc58a47a2f0a84ab6ffd036cced1a05a0ab1db2fe69d1ef0d6d975d4f51d9bca700ff2658a2cdc85373e14cc0f8e2ff7e94bccfbd125cc1125181aa347
MD5 SHA1 SHA512

Submit Download

memory/4644-17-0x00000000013F0000-0x0000000001400000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads