88d44a82b73c7001250459df8e6d748f8bdfdf553af9c335ba93c8f2dfb6533a

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Debug كرت فسشضي.rar
Size 4.4MB
Sample260812-dcrtwstygx
SHA256 88d44a82b73c7001250459df8e6d748f8bdfdf553af9c335ba93c8f2dfb6533a
MD5 fe8e1e4da3b6a3595e07bcaaaa7401be
SHA1 8681c070f3f44112783f412e5423db1ab67d4b7f
SHA512 a2999999ea12420aaceda807b2006b0ee1fdd4b35dd059fae9dce0d65846eb16da47a949d735861b1c743ad497b129294e4049068fa7bfbe1457d001f06c5f47
SSDEEP 98304:fpbggF52j796Bk6gJki+coUxtKLFOZD+Mbqn9Lc5OXLlFwAUQ4raHK:hbgW52j7wG6gJkjvUuJM6saLlRKOK
TLSH
T139263301622F1D8DA3DD2279D2CFA5EB311B7EC4E09AE8D05707FD92DD86A9CCA584C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	سش.exe

Executes dropped EXE 3 IoCs

pid	Process
2800	سش.exe
4900	Creative EAX Setting.exe
4388	EAX Console.exe

Loads dropped DLL 3 IoCs

pid	Process
4900	Creative EAX Setting.exe
4900	Creative EAX Setting.exe
4900	Creative EAX Setting.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Creative EAX Setting.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Creative EAX Setting.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Creative EAX Setting.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Creative EAX Setting.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
696	7zFM.exe
696	7zFM.exe
696	7zFM.exe
696	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
696	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	696	7zFM.exe
Token: 35	696	7zFM.exe
Token: SeSecurityPrivilege	696	7zFM.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
696	7zFM.exe
696	7zFM.exe
696	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 2800	696	7zFM.exe	96
PID 2800 wrote to memory of 4900	2800	سش.exe	98
PID 2800 wrote to memory of 4388	2800	سش.exe	99

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Debug كرت فسشضي.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:696
- C:\Users\Admin\AppData\Local\Temp\7zO8B296059\سش.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8B296059\سش.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting.exe
    "C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\EAX Console.exe
    "C:\Users\Admin\AppData\Local\Temp\EAX Console.exe"
    3⤵
    - Executes dropped EXE
    PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

سش.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO8B296059\سش.exe
Size 4.0MB
SHA256 967c0585dd0aa756ce76ee84bd9675a4f51326655037c023fb2eb8ac87f12a93
MD5 e4101132b5ce30569eef31cc426af12d
SHA1 e1be335efe21c45be49b352ba2703c1a736a2481
SHA512 112e068eb7d6225c26584f8661adc51861844a665c4bcd5e9c7367d04722e61c97e671dfe3526ad15f1a1c443808dbf698d73e98b1c74f94034ca159a6f7c7d6
SSDEEP 49152:8oHa0o5IZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZAl7cRNgdr9YGt:GPl7cMEGwdbPqFtPaGC+S+6Y5OiH
TLSH
T1D516CEC16F8EF692E61771E02A2E2EF0A7D02D3587D91736335FF9A26A71071205AD31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Creative EAX Setting.exe

Path C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting.exe
Size 1.3MB
SHA256 f8e402f7347ece2a70033c112e4713ddcd7a4b3d829d915fc1c46723a00340c9
MD5 aaf56be85c14fc2a4081650711413d20
SHA1 3eb22a0b302c60a059a501d3ae27c4d2e4c77360
SHA512 0a8072518e0e3b286d4fc43a98b2b0a64ec93f0feaf069771e9cb96088bd632b86acf07bd99917d88389c847d889314164c929955f52bd9ad8a8a63dc93ccb4c
SSDEEP 24576:5auTadReBgaMj3XRD+uVK2H2Cuk1+Lda3WvhMV+O/mDo5uaij:0ummBgaMj3XRD+ufH2Cuk1+Lda3Wvhoa
TLSH
T137556CD2E84489D4F92E09B3A0679DB016A31D7EEDF4A49D64C9BC2B15B3353503F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EAX Console.exe

Path C:\Users\Admin\AppData\Local\Temp\EAX Console.exe
Size 20KB
SHA256 691513f86994e8438a87f7852502e89e75884c1b457bbe222c2efee0b0417dcd
MD5 1cfc4c5938c644d00196afc4fc3d9564
SHA1 5f58a3e26e0991219292554d9fe3fff9ac82a547
SHA512 99973b865401949bd09e3e0fea6b95e4a9bb0bd6e0572e1ffcc24f945467c66c3c9990abc750deb869541051239ef6944967c9189136743b0eef49c7025e6bd9
SSDEEP 192:4ckxW90jCtyI14cksUkj/wNokoJdDXX7+Lku1HedSwh+cw79:49W9P914ctUGwNro/+Lku1HednhTwR
TLSH
T16892290BA31354EAD11BE5B8C9FF1732B571BE72CAB2072D5260D6B42F607802B29F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Guna.UI2.dll

Path C:\Users\Admin\AppData\Local\Temp\Guna.UI2.dll
Size 2.1MB
SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
MD5 58459aefb74d5ff786b9efb982d44eab
SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
TLSH
T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoicemeeterRemote.dll

Path C:\Users\Admin\AppData\Local\Temp\VoicemeeterRemote.dll
Size 156KB
SHA256 5d85a8e00c714a707a65671936fb49611f4e7751a9065c618804ed5ca47872cb
MD5 79b4ef6b17d0a8bb825437773c1d8e3f
SHA1 255fbeb8ad45faad93afeac2afa2cb7e7d78d079
SHA512 0c76b45b3c311f34de0087755d63e7966edf24ad77360897475854ff66421ce55e93f35a78ea10f15cce8ccc505618d12dd6114eabc89b73a1e468f5b16799f9
SSDEEP 3072:+cvA+X1yaikOLqMvbJl1rvVygoP5UG7GjSVX:PYH1rtyrQjS5
TLSH
T1E6F3AF1376D240F6D5813EBD14E7373BEF3AAA5648668E438B98DD521C31352BB2620F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2800-12-0x0000000000EC0000-0x00000000012D2000-memory.dmp

Download

memory/4388-50-0x00007FF6B98B0000-0x00007FF6B98BE000-memory.dmp

Download

memory/4388-49-0x00007FF6B98B0000-0x00007FF6B98BE000-memory.dmp

Download

memory/4900-41-0x00000000053D0000-0x0000000005462000-memory.dmp

Download

memory/4900-45-0x0000000005E90000-0x00000000060AC000-memory.dmp

Download

memory/4900-46-0x0000000006110000-0x000000000611A000-memory.dmp

Download

memory/4900-40-0x00000000058E0000-0x0000000005E84000-memory.dmp

Download

memory/4900-39-0x00000000008C0000-0x0000000000A1A000-memory.dmp

Download