58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
Size 6.9MB
Sample260814-dfct5ss1hs
SHA256 58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d
MD5 d6bccf7d7a6a4f8744e2aeef501f2528
SHA1 670ee627c9a8acce3b5cdc90ddfa7fa614f07f38
SHA512 8d74afbecb138a09b65ca3b9c516a6b075af30fc0b967e9bf3f67e1a02f39d87e6b631caeaebc678a69b68e0f11e45d63e4944040af864b164ed4175c93a717e
SSDEEP 196608:SU2i1m+wYI70f9s9IyjHYSMluM6QpguSKpd2:SU0+C8KIyjHYhluMbWRKpd2
TLSH
T11A7623511212A38BD5AD7233D7230C9EB6562E7AD070891E9520F9DA20FF2478EF75B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5548	HuYanBao.exe

Loads dropped DLL 5 IoCs

pid	Process
980	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
980	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
980	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
980	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
980	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\护眼宝\resources\chunk.blob	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
File opened for modification	C:\Program Files\护眼宝\resources\chunk.blob	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
File created	C:\Program Files\护眼宝\HuYanBao.exe	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
File opened for modification	C:\Program Files\护眼宝\HuYanBao.exe	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
File created	C:\Program Files\护眼宝\uninst.exe	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
File opened for modification	C:\Program Files\护眼宝\uninst.exe	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
File created	C:\Program Files\护眼宝\uninstall.exe	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HuYanBao.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
980	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
980	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
980	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
980	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5548	HuYanBao.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	980	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
Token: SeSecurityPrivilege	980	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5548	HuYanBao.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5548	HuYanBao.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5548	HuYanBao.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 5976	980	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe	81
PID 980 wrote to memory of 5976	980	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe	81
PID 980 wrote to memory of 5548	980	58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe	91

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5976
- C:\Users\Admin\AppData\Local\Temp\58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe
  "C:\Users\Admin\AppData\Local\Temp\58002db8244894a2324b99c710e292de7a90ce0db78fdce43b0ee6b263bb350d.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Program Files\护眼宝\HuYanBao.exe
    "C:\Program Files\护眼宝\HuYanBao.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:5548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HuYanBao.exe

Path C:\Program Files\护眼宝\HuYanBao.exe
Size 4.9MB
SHA256 e6ff1a6d784500d4a10ebc65da089417116de6332175a44a64593bdd23e024ec
MD5 c5475cb4d350a8c8ade70fd32187325a
SHA1 b611a53316d24acea072bf371c9c46963c1b8391
SHA512 cc566e0c10111dbf72f4b0286ef4edcec90047e79ff5213c2a2e75eeab605d671a9de9a0e989e99d4814b3728888700a34d8940a08ebb77fd57d382bcee26632
SSDEEP 98304:YSXX8f/47cvoRasMDHqKwRsfnxlek12jajAxWuN8C+8i1qD1A/LdQZklBIpH40SQ:Y4JKBze2cKAxWuN8C+8i1qa/kSIpHfP
TLSH
T12036D02136608176C13E2132955BB36FA979AD601B3141C77598FDFE2BB12C35A3B23B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5C40.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5C40.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5C40.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5C40.tmp\nsis7z.dll
Size 1.3MB
SHA256 338fe675307f40fd0d717d5957953e22db145a10903dc465071d7e602d7e298f
MD5 5832c2246c601cffc1b3d173af07ab2f
SHA1 a2c75b7eeb276cdc948c560418c1d7acbb1d6d93
SHA512 c62c8a622c76ef6e6995869ddd56b39cf24a37fcaafc2f017112ae1cf6bdba5f5cdb3f775fb473691e56291fd4d6e69b50f3fe0e6a076492016399e50d54f3d1
SSDEEP 24576:97mgt08WdvNfx8oh5N5/y4eYxV/yqiF4INklNtCwFQRqYQiklN/GS:76LfnhM4BIklN0wuqYQiklJ
TLSH
T1BF558E60ADB2C0FAD10F9B70E53D673F6A3243278E0C896FDA589DB85931561F10B61E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5976-19-0x0000000004E10000-0x00000000050A7000-memory.dmp

Download