de6782a7f87b12de125037969570230edc0c6c80145200a5d1230cd41df0ba96

Analysis

user interaction
yes
max time kernel
209s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Thundry-win-Setup.exe
Size 104.9MB
Sample260813-wydhhawcqa
SHA256 de6782a7f87b12de125037969570230edc0c6c80145200a5d1230cd41df0ba96
MD5 f0b15f0da21af468047307d98481508c
SHA1 084f8d71db01d60020994dcdda3c89148feef64b
SHA512 03b188acdb217dc944460e35d06218e49071e04d6560e27bb7b6a071701cc256ad00fa20b79cb0bd249c4313bd4c8047ae6b2e3902bc2691382769b1e8842101
SSDEEP 3145728:dlH2V/ekjxe/6N5mA7wy/FKD7K0kWSqPGaOR43gAJ:Dqe/6N5XMy9q+03PdOR4QS
TLSH
T189383322FE41D0BBD4CA01B5D43EFB39BB3A919A8B1E85C357E9481859E13A09C1735F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Thundry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Thundry.exe

Executes dropped EXE 3 IoCs

pid	Process
4732	Thundry.exe
3176	Thundry.exe
1816	stockfish.exe

Loads dropped DLL 3 IoCs

pid	Process
3176	Thundry.exe
3176	Thundry.exe
3176	Thundry.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Thundry-win-Setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4740	Thundry-win-Setup.exe
4740	Thundry-win-Setup.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	Thundry.exe
Token: SeDebugPrivilege	3176	Thundry.exe
Token: SeLockMemoryPrivilege	1816	stockfish.exe
Token: SeLockMemoryPrivilege	1816	stockfish.exe
Token: SeLockMemoryPrivilege	1816	stockfish.exe
Token: SeLockMemoryPrivilege	1816	stockfish.exe
Token: SeLockMemoryPrivilege	1816	stockfish.exe
Token: SeLockMemoryPrivilege	1816	stockfish.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 4732	4740	Thundry-win-Setup.exe	85
PID 4740 wrote to memory of 3176	4740	Thundry-win-Setup.exe	86
PID 3176 wrote to memory of 1816	3176	Thundry.exe	100

C:\Users\Admin\AppData\Local\Temp\Thundry-win-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Thundry-win-Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Users\Admin\AppData\Local\Thundry\current\Thundry.exe
  "C:\Users\Admin\AppData\Local\Thundry\current\Thundry.exe" --veloapp-install 26.9.3
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4732
- C:\Users\Admin\AppData\Local\Thundry\current\Thundry.exe
  "C:\Users\Admin\AppData\Local\Thundry\current\Thundry.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Users\Admin\AppData\Local\Thundry\current\stockfish.exe
    "C:\Users\Admin\AppData\Local\Thundry\current\stockfish.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1816

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\29d5098288964f1ca4473fdf75bfcbbb /t 2096 /p 3176
1⤵
PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Thundry.exe

Path C:\Users\Admin\AppData\Local\Thundry\current\Thundry.exe
Size 46.5MB
SHA256 8e648b55c3e15f808456e0cfec8d8fbbbf43e13664ea73e3e4133dc0a4b2af80
MD5 8ab272ebb32d729b663d58dd35495394
SHA1 fd9570c8df65c80658d7ab277be975aec597beb6
SHA512 dedd009caa3f8aa6bd08e8d1c3c27f895ab5710ac070e6b835f90226084a8a98bae62b6e2d76cbce2ac198cdfc1a279a3080181fa8f0be4edb4f46b10c983215
SSDEEP 786432:DGa7doUOeU9ChBGkwv30tcZjpQIvseA9p5dCekEjSZWfRL:DGa7doULUX3pNvsj
TLSH
T15BB75906B7848DD3F12299B4CA26C732D6B0BCB45235831E2469F7071F3BF546E5A62B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

av_libglesv2.dll

Path C:\Users\Admin\AppData\Local\Thundry\current\av_libglesv2.dll
Size 5.1MB
SHA256 53191a77fe783cd757ca7767077c2a64a662e7043777a5b4ab74980d4a0b73e3
MD5 e6198925c32669264eb2a37a5c5706bb
SHA1 f2bad0cfc40bc642dfcd7242c3fcfe736b617eab
SHA512 d2836c7335e70171d2dc0e143b9752b1d4947d3b6fe424c2078118aeabf12ac008b7be91adcba6e2616e143c5732afa6a0089f412a5e2d97a3ad76aed6c99aa7
SSDEEP 49152:UrRhIIcDUAsu5h76YosYgIiiHtY+52ZKLArXaqxRyiEIrYeoEFjWhM+/9+XmEFqZ:aiQsmz2ZdKMyiEIrYeoRnL6Uyfq
TLSH
T190467C03F29250DEC41DD278875B9223F635B8450725B6DF26A893252F77FE06B3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libHarfBuzzSharp.DLL

Path C:\Users\Admin\AppData\Local\Thundry\current\libHarfBuzzSharp.DLL
Size 1.7MB
SHA256 145ade963eba427027d5e1381db5d51a0ef9e98e9fef9efbfa6074ca20da246f
MD5 fdfc5facbb8d7ed52bcfeda911586cd6
SHA1 ae248fd8f3e3df80bab5dacdc098a0a7136ba94d
SHA512 d49b78bda3a0e70e5b70eb537ce5cf28b00c5578d8edd2e5bd0e9b8dbc3e6cb983bb5ea38dfda0170ff2851fecd78e702c00c7483628d920527546e94903a5b1
SSDEEP 49152:48lOq9ewF9RTbAsC0e+yPWojc7dGl09x4HJg:I2dclAJ
TLSH
T19C85AE4AE2AA10E9D9BFC078D666950BE7A274050314DFEF25E08695EF23FF5167E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libSkiaSharp.dll

Path C:\Users\Admin\AppData\Local\Thundry\current\libSkiaSharp.dll
Size 11.1MB
SHA256 7dec3ba900ab353491e6446f0083739924c6f8dd668832e2f09d38ebffdbbe1c
MD5 7b0859b4d5a23d2436bd165f86bf9d4c
SHA1 a8cb4ecdca12e2b07974b0478c9f5494e283d784
SHA512 0b87163b211c0da87af194f9438d397489e2a9d550b4f56613ce8e44ea7a48d3676fbb8161fe72050401618e69eefa7da12c0f7a3d7634ad78c461a572409de0
SSDEEP 98304:51DUue0xnR1JG+VyXb0UDfgFTdbkLhQgPLSmrQ7zMEGFD:51DVUDoPkOgPLS5MEGFD
TLSH
T1FCC65C02769B54BDC44AC4B4934B5A67AD2434CB0B35BCEF418592393FBABF42F39618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sq.version

Path C:\Users\Admin\AppData\Local\Thundry\current\sq.version
Size 468B
SHA256 84d4362b948e55d7d7be05e4b786af1df617ad50d81f008bde22b2ec8cf35345
MD5 adc22356f1c2d2b386736cfb377c158c
SHA1 61f4ac02344b8ed24ad5ad068187bb8339ce9f24
SHA512 3ad0d11f312b4d8b4d4d4cf45ec33047d4b1a10e76d917b636e8672565718ebdca37667066d9d262ccf3125d4eee984cbe2d6762f211b0821daca5de706139da
TLSH
T166F0978CDA80E3078762133457C08144ABFA6E6EA9C08870E488AC1922C52CEC81B886
MD5 SHA1 SHA512 TLSH

Submit Download

velopack_Thundry.log

Path C:\Users\Admin\AppData\Local\velopack\velopack_Thundry.log
Size 1KB
SHA256 3b9132354106435c40569090bdfbeda95fa856f0a0aabbc073f54bed35ff7f8b
MD5 3c4f5ba7ddd0d1c5f3681ea5f199db18
SHA1 a8a854ade39b271d50b32a580bf427b1552c56ab
SHA512 8c0117fac8a06974ce9abafbb9546bf9202cd6ad08c613eaabc368664e119c2d7958a33c5038d2cf1dd9a596aaf56617a1de00a596ebe3a7a639be5bac3542ef
TLSH
T1D5316C8CF690A26BE505476761F2FAC547AB1B4B3FC3D18B0A12A204F1556DCB3CA35A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1816-41-0x00007FF7D6B70000-0x00007FF7D7B70000-memory.dmp

Download

memory/1816-42-0x00007FF7D6B70000-0x00007FF7D7B70000-memory.dmp

Download

memory/3176-27-0x000001D299EB0000-0x000001D299EC0000-memory.dmp

Download