c52fc1b11915c55deeb733db5324b7bfde83eb8fa00af592043b12ac67ea965b

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Serv-U FTPServer_v6.3.0.1.exe
Size 2.4MB
Sample260809-wvrkystbmf
SHA256 c52fc1b11915c55deeb733db5324b7bfde83eb8fa00af592043b12ac67ea965b
MD5 b40c1054f6234887d7e0247791dd2b68
SHA1 a677f68e0c58c185afe0723545a22d282a45d083
SHA512 cb4e880a913bf098d295dac39c824f0105eb8f6a1ad6684461ee98eb2d68398e954130d766b04c276e487d20af003f7c99c209243f86f18b9bc44bbfb92345ea
SSDEEP 49152:f6dDUZgKtPKPJSyl890U5KKTvbIGZyzQYgq8jp4NtKDmJ6Zul:idDskJLl82UZTvJZypaDCJ6wl
TLSH
T11CC533815FF0F6F9C8018B357CA561FD99AFED11AA2822372A0C3D4DBBB53644D49718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
5728	is-V67PS.tmp
4840	SetupUtil.exe
1780	SetupUtil.exe
2728	ServUDaemon.exe
2412	SetupUtil.exe
4248	ServUAdmin.exe
3176	ServUDaemon.exe
3852	ServUTray.exe

Loads dropped DLL 16 IoCs

pid	Process
5728	is-V67PS.tmp
5728	is-V67PS.tmp
5728	is-V67PS.tmp
5728	is-V67PS.tmp
2728	ServUDaemon.exe
2728	ServUDaemon.exe
2728	ServUDaemon.exe
2728	ServUDaemon.exe
2728	ServUDaemon.exe
3176	ServUDaemon.exe
3176	ServUDaemon.exe
3176	ServUDaemon.exe
3176	ServUDaemon.exe
3176	ServUDaemon.exe
3176	ServUDaemon.exe
3176	ServUDaemon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Serv-U FTPServer_v6.3.0.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	is-V67PS.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServUDaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServUAdmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServUDaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServUTray.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4840	SetupUtil.exe
4840	SetupUtil.exe
1780	SetupUtil.exe
1780	SetupUtil.exe
2412	SetupUtil.exe
2412	SetupUtil.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 5728	1944	Serv-U FTPServer_v6.3.0.1.exe	89
PID 5728 wrote to memory of 4840	5728	is-V67PS.tmp	90
PID 5728 wrote to memory of 1780	5728	is-V67PS.tmp	91
PID 1780 wrote to memory of 2728	1780	SetupUtil.exe	92
PID 5728 wrote to memory of 2412	5728	is-V67PS.tmp	93
PID 2412 wrote to memory of 4248	2412	SetupUtil.exe	94
PID 2412 wrote to memory of 3176	2412	SetupUtil.exe	95
PID 2412 wrote to memory of 3852	2412	SetupUtil.exe	96

C:\Users\Admin\AppData\Local\Temp\Serv-U FTPServer_v6.3.0.1.exe
"C:\Users\Admin\AppData\Local\Temp\Serv-U FTPServer_v6.3.0.1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\is-UG8OH.tmp\is-V67PS.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-UG8OH.tmp\is-V67PS.tmp" /SL4 $4009E "C:\Users\Admin\AppData\Local\Temp\Serv-U FTPServer_v6.3.0.1.exe" 2282436 71168
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5728
- - C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\SetupUtil.exe
    "C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\SetupUtil.exe" -checkfirewall -ini:"C:\Program Files (x86)\RhinoSoft.com\Serv-U"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4840
- - C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\SetupUtil.exe
    "C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\SetupUtil.exe" -checkreggie -ini:"C:\Program Files (x86)\RhinoSoft.com\Serv-U"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\ServUDaemon.exe
      "C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\ServUDaemon.exe" /k "c:\program files (x86)\rhinosoft.com\serv-u\ServUDaemon.ini"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2728
- - C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\SetupUtil.exe
    "C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\SetupUtil.exe" -shutdown
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\ServUAdmin.exe
      "C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\ServUAdmin.exe" /s
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\ServUDaemon.exe
      "C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\ServUDaemon.exe" /s
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\ServUTray.exe
      "C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\ServUTray.exe" /s
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RhinoNET.dll

Path C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\RhinoNET.dll
Size 100KB
SHA256 d029921c3765fff819ba17d3097b9328c98f6819ee14b83702b37d0dea9bab2c
MD5 fd0d212ac0b1ca69863967cb2b038586
SHA1 01fd56785d9e384af658df55fb168ffc895cb225
SHA512 2f66b32fb2a1bc43c71a39f714c523c922b8b13809b4e0bbdcac1a149a5d889032945cf3acf40548eb35599e4e825d87155080c08a2f4cc74701c37caabb5cec
SSDEEP 1536:hApSE6C7cFP6RDXa8albve1/xaT6F/BrNQkt8LZBVrM8tr:hAAkcF+Da86vSJaTPoYPrM8
TLSH
T1DEA36D0237D390F1C24BB3B2AE121B23D3FA9D50D9E96A0357DB4AAB1DF775A4612704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServUAdmin.exe

Path C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\ServUAdmin.exe
Size 2.5MB
SHA256 4e5529627759ffee673f05ff3b4ab94e8d01f4a83c2e29a239c7596bd6417959
MD5 5dd0a475043c408095baa96f2252477f
SHA1 ba4a5137e7304be2655ed110e51dc14c743c298a
SHA512 2143a6192513cf0d6ad18134def33fa4500e0181a528059a965bf6ad993b4df9d3e57d54008d37bf3ef3e6c93d89ce20d08f512ce5b604ca5f1bb73926f2f339
SSDEEP 49152:WPwrHFdwu54mXX2MUUKIUFtoaBQriFhV9o1TB5NYUgQAxi87cMDL:tT5HXXIZHol6UgnL
TLSH
T1FBC51812F691C833C09203B6592AEBF46076BFB4BA30555773E46E0D7AB0BD2AD25347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServUDaemon.exe

Path C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\ServUDaemon.exe
Size 808KB
SHA256 571516b03f13f51c05982b9c82891e14c3e57750bf8d99b0c2b95ede907ce0c0
MD5 5ca61d5af70a3a7a30d948cd0a455397
SHA1 7a81bfe7294b2a3ded88c018084fec7f644123b6
SHA512 53b7bb221633409d95fbe211ce7a90c662aa1090786b7869e0ed0d44aa6964dc91d50746e80d51d3f964204174ab5ef5d69d3d16b2d99d1b63ff0d0dc5dab56b
SSDEEP 24576:leQaJ5pRe6DBQJowbQaKdDYTbsqpHs4HXD:lSJ5pRe6lQJoXqpM4H
TLSH
T1A1055C22F2988132F0610631D56D5B27D5F9BAB1362EAD47F301463978B4AC39C69F2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServUTray.exe

Path C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\ServUTray.exe
Size 64KB
SHA256 eac498df983fab0caa916ca6c3f69c12e8917230202b9d1461ed5e2156ece2f9
MD5 ff6537eae9a49530e7d0d039f5e41e69
SHA1 199fff22d6fedbb57bea2596d2062d5342f73745
SHA512 e3eb375bd3296d9650b0ddfa66ddaee89b44a4b8a4933c59298b2c9d47fe56ab2007be668e7d7bcf35e25973f848a675042f2eb36abf4aed1935de1ac63700cb
SSDEEP 1536:DDR5D8dF2vc+tojgXBk13NB7N29R0rzj6FDP:Dz84toCBawgjkDP
TLSH
T1CF538B237890C4BAD495067809769B959B77FD010371C98B1FE018CFBF726EA9E3A316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupUtil.exe

Path C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\SetupUtil.exe
Size 244KB
SHA256 bbd5f8414b562a9afb9becd39c63e8aa0e1f2d2d9e04c0ed99fa09b88f4be8e8
MD5 4ff546fff9208ef15abd686e2cacbede
SHA1 3df25602ed4850bc059b873a77117277f11865f9
SHA512 cca982ff794032bf38c43fe85ef87bd0fe20fdc109f29782549d6d92827b403a04d5c3c3c6ece1a46c2dfc1d19c1683cf47427b6e97075f601b9683389791e95
SSDEEP 6144:XkNqiQhaADxQVrzQ3CNfvTWTsIhvCFVa:0NNMaADYniTw
TLSH
T13F345A1672E0C176D0B326308AE597B572FAFC108BB6874B37553F0E6F316C59A29362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp71.dll

Path C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\msvcp71.dll
Size 488KB
SHA256 df96156f6a548fd6fe5672918de5ae4509d3c810a57bffd2a91de45a3ed5b23b
MD5 561fa2abb31dfa8fab762145f81667c2
SHA1 c8ccb04eedac821a13fae314a2435192860c72b8
SHA512 7d960aa8e3cce22d63a6723d7f00c195de7de83b877eca126e339e2d8cc9859e813e05c5c0a5671a75bb717243e9295fd13e5e17d8c6660eb59f5baee63a7c43
SSDEEP 12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
TLSH
T17BB4D71377434AF2E086B3F576C6032297F6FC654A25B31392DFE4642F9A38951B3A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr71.dll

Path C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\msvcr71.dll
Size 340KB
SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
MD5 86f1895ae8c5e8b17d99ece768a70732
SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
TLSH
T10374C012B1A3CCB3D0B6007449596B599BBFE43046798A73BFE80E4E4F746D1D726A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\is-N1OMR.tmp\zlib1.dll
Size 58KB
SHA256 b09537250201236472ccd3caff5c0c12a5fad262e1e951350e9e5ed2a81d9dde
MD5 80e41408f6d641dc1c0f5353a0cc8125
SHA1 6d957ba632df5b06d49a901f2772df4301610a2a
SHA512 857d4dc087c73f00d79bf70edfc67ddc0b15a86a4fff366d91e5ef6684af43eed7dcf8579f6b4fb35dedd090973e2bde1a82aae07642136b608eeb1d567e5c03
SSDEEP 1536:b/jUwfZ7BURaHUry7nToIfYIOlIO+CM6:1x7BURaHUrgTBfev+CM6
TLSH
T1F9437D1293C197A6D8FC263554DA972DCB32B6050BAEC6D3A4CC6FE558523E0E6312CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-V67PS.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-UG8OH.tmp\is-V67PS.tmp
Size 666KB
SHA256 58d19e4f8e8b4614f446df78aa56648f6724c5ff88cf848226ded08991db660b
MD5 183727f6351dea1889a416ee4dd145b6
SHA1 3ea4079fbd9e81231b9061ff3b06bb52e5df96a2
SHA512 ea1b7395e8b553a8d29d0168e166515816586de08bdf2ac3b34fb6b9e4dfc31b0010441b534e45216090c46fc6fd55d89614d8383f614205fe89e1d594ae170b
SSDEEP 12288:LeuHnWgyrgVu4rPy37WzH0A6uaF4Ad7dNsVN1qRqhD1mxOS:yuHcrgVxrPy37WzH0A6uwpd7QN1DJmxl
TLSH
T1AEE46A23B2A0D837D0B32E749D5786E5592AFD102F34A5973AE81F0C4F39691792B3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1944-0-0x000000000040C000-0x000000000040D000-memory.dmp

Download

memory/1944-66-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/1944-1-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/2728-50-0x0000000000660000-0x0000000000673000-memory.dmp

Download

memory/3176-63-0x0000000000A90000-0x0000000000AA3000-memory.dmp

Download

memory/4248-54-0x0000000000400000-0x000000000068B000-memory.dmp

Download

memory/5728-70-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5728-78-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5728-8-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5728-9-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5728-72-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5728-74-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5728-76-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5728-67-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5728-80-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5728-82-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5728-84-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5728-86-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5728-88-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5728-90-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5728-92-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/5728-94-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads