Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/08/2026, 03:56

General

  • Target
    46e39924118a1bcb25a0e7c38399382de762dc60c2a60247bbf9472cb7241b37.exe
  • Size 12.6MB
  • Sample260814-ehm9bsfa77
  • SHA256 46e39924118a1bcb25a0e7c38399382de762dc60c2a60247bbf9472cb7241b37
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 10 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46e39924118a1bcb25a0e7c38399382de762dc60c2a60247bbf9472cb7241b37.exe
    "C:\Users\Admin\AppData\Local\Temp\46e39924118a1bcb25a0e7c38399382de762dc60c2a60247bbf9472cb7241b37.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Users\Admin\AppData\Local\Temp\is-4D687.tmp\46e39924118a1bcb25a0e7c38399382de762dc60c2a60247bbf9472cb7241b37.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-4D687.tmp\46e39924118a1bcb25a0e7c38399382de762dc60c2a60247bbf9472cb7241b37.tmp" /SL5="$8015E,12387260,832512,C:\Users\Admin\AppData\Local\Temp\46e39924118a1bcb25a0e7c38399382de762dc60c2a60247bbf9472cb7241b37.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5948
      • C:\Program Files\GeekChat\GeekChat.exe
        "C:\Program Files\GeekChat\GeekChat.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3904

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        GeekChat.exe

        • Path C:\Program Files\GeekChat\GeekChat.exe
        • Size 48KB
        • SHA256 6b60462950fd28a49a75c58c9e760995814408ec7ad3ece787c7a4dc8abcb590
        • MD5 SHA1 SHA512 SSDEEP TLSH

        app.so

        • Path C:\Program Files\GeekChat\data\app.so
        • Size 12.2MB
        • SHA256 e094cd6befd1c65114e57b5bd04231357368d93b31a734409279fdc0f35d7671
        • MD5 SHA1 SHA512 SSDEEP TLSH

        .env

        • Path C:\Program Files\GeekChat\data\flutter_assets\.env
        • Size 32B
        • SHA256 930ba0793d265483c8bcbb86227c8aab3d4037dc1efc7fffb0973c90f9214b41
        • MD5 SHA1 SHA512

        FontManifest.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\FontManifest.json
        • Size 2KB
        • SHA256 3e539eb8e13186dd811e23ff3abd9b67fb86da1ebdad2263ef7d83bf75c233c0
        • MD5 SHA1 SHA512 TLSH

        en_US.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\assets\locales\en_US.json
        • Size 867B
        • SHA256 7af5fdb8664a3c0db169dc6bb350325f5b11f4b0c9df9f81897084f5fe7064ff
        • MD5 SHA1 SHA512 TLSH

        ja_JP.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\assets\locales\ja_JP.json
        • Size 1KB
        • SHA256 442a99c8ca70aefacca1e84398a962392437b6c84e6a38a6fe79af6106c11ed6
        • MD5 SHA1 SHA512 TLSH

        ru_RU.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\assets\locales\ru_RU.json
        • Size 1KB
        • SHA256 34587c7f6cc67359018194a23a0c5a856bea61a5ce998b8ac4bc15e7e05baa76
        • MD5 SHA1 SHA512 TLSH

        zh_CN.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\assets\locales\zh_CN.json
        • Size 880B
        • SHA256 3912e08a24dc00a7ae789bfae054f925ddf0353fa9d6e1204cc46206c3a9a536
        • MD5 SHA1 SHA512 TLSH

        zh_HK.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\assets\locales\zh_HK.json
        • Size 850B
        • SHA256 9921bf1f31998416743cd34deae5719fc53eaee1ddd655ae9fa95fe0d7675edd
        • MD5 SHA1 SHA512 TLSH

        MaterialIcons-Regular.otf

        • Path C:\Program Files\GeekChat\data\flutter_assets\fonts\MaterialIcons-Regular.otf
        • Size 1.6MB
        • SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cl100k_base_1.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\cl100k_base\cl100k_base_1.json
        • Size 152KB
        • SHA256 5d6d53bdc6df63da6285708246831b272df1accbc59b077477479606846018c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cl100k_base_10.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\cl100k_base\cl100k_base_10.json
        • Size 192KB
        • SHA256 9c60eed483096c652a5966ffea5eccd0b8e8e0cf98a31fd8b0b9726e1fc453df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cl100k_base_11.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\cl100k_base\cl100k_base_11.json
        • Size 5KB
        • SHA256 4c32e44e92b91eb3a0a3d1183909b78c0e199f53792a6739f950de76085eecad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cl100k_base_2.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\cl100k_base\cl100k_base_2.json
        • Size 176KB
        • SHA256 b43f629dfbd90ec44d2c8f76c1f3bce97d855b707a1e76f7c5eb9e2614d0bd7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cl100k_base_3.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\cl100k_base\cl100k_base_3.json
        • Size 179KB
        • SHA256 75dcc29462ae8590091e2558eed90c9a50635dac05a9b97548cf21ceb3b2a985
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cl100k_base_4.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\cl100k_base\cl100k_base_4.json
        • Size 183KB
        • SHA256 3b3f5a46fb7053680299b63df0dab222fb52053639f0af1f9cdecb8bd1e24311
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cl100k_base_5.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\cl100k_base\cl100k_base_5.json
        • Size 186KB
        • SHA256 a92d30c22abb6e3bff17d0fc47e4a3d442ecdcd1ca83fa90aa51e1cffd9c7be7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cl100k_base_6.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\cl100k_base\cl100k_base_6.json
        • Size 187KB
        • SHA256 8800d5c0f87a1d41bd0cb3ec61a28e05e5d4740084a7d0978ad657607abc7a17
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cl100k_base_7.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\cl100k_base\cl100k_base_7.json
        • Size 189KB
        • SHA256 165454eac91d5a42ffeedf67652ef9fe3691248e889b66a58119226b897909f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cl100k_base_8.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\cl100k_base\cl100k_base_8.json
        • Size 190KB
        • SHA256 7d030784a5b0fd2f34032a9a27eaf2169dda09030f957d43e4108654e3ca2f3c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cl100k_base_9.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\cl100k_base\cl100k_base_9.json
        • Size 192KB
        • SHA256 0e8efe810a8f5ffd079a46946af29dd5af12261a21f84e83946c4ddd72308f7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        p50k_base_6.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\p50k_base\p50k_base_6.json
        • Size 5KB
        • SHA256 029af91d399e7d3beb85714e76e4a36f37881c8a82a945d7b47ef32ae004742b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-67TNJ.tmp

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\r50k_base\is-67TNJ.tmp
        • Size 188KB
        • SHA256 bb4009c25701733530b1bc02a123253e1fa6a9a3407e0c2880a59c1d239ed607
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-B1QT7.tmp

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\r50k_base\is-B1QT7.tmp
        • Size 189KB
        • SHA256 973532df0dd54d4a23ed28b6443454a8ed2c88001e6a3e5c0cc15d7b36d1c197
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-KRHUJ.tmp

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\r50k_base\is-KRHUJ.tmp
        • Size 4KB
        • SHA256 95e03c87f7ed231aac5c63eb3df8181fe8fd33622800be2a807caf73dfa8e957
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-KTEQH.tmp

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\r50k_base\is-KTEQH.tmp
        • Size 186KB
        • SHA256 31780706e4a1c6051885e948573795c781e464b7bd82fcba6a36e340f4e38e71
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-U7B0F.tmp

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\r50k_base\is-U7B0F.tmp
        • Size 160KB
        • SHA256 0ed46eb1a91eccf64306a51922bfdf9b422debfb08bcb62322eae1a692dc9911
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is-VQAVP.tmp

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\flutter_tiktoken\lib\tokens\r50k_base\is-VQAVP.tmp
        • Size 185KB
        • SHA256 b0f927c166426d292d0d96374246933f63859a236ebf69d028e126548fff0af1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en_US.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\geek_chat\assets\locales\en_US.json
        • Size 3KB
        • SHA256 85446b1a1023b4dc589760a0780256b758f3b70662115a22ec9e939b62eecec5
        • MD5 SHA1 SHA512 TLSH

        ja_JP.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\geek_chat\assets\locales\ja_JP.json
        • Size 4KB
        • SHA256 ce7e68bbf26a73abd4412775f795704c0852336542c865ee6dd847cb0b2ea869
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru_RU.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\geek_chat\assets\locales\ru_RU.json
        • Size 4KB
        • SHA256 8265dda2d38e07ee5688908142727900dd5b1193b30fc4696c1deb356f7d2d2f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh_CN.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\geek_chat\assets\locales\zh_CN.json
        • Size 3KB
        • SHA256 e1e2659a4f3e18b98c612e13fe98fde62dbdcbf868928ec5cdf2323fabe2c2ee
        • MD5 SHA1 SHA512 TLSH

        zh_HK.json

        • Path C:\Program Files\GeekChat\data\flutter_assets\packages\geek_chat\assets\locales\zh_HK.json
        • Size 3KB
        • SHA256 852a0f858f025a9bea6f241067f369515828006ec7b862dde920cfed8f144b00
        • MD5 SHA1 SHA512 TLSH

        icudtl.dat

        • Path C:\Program Files\GeekChat\data\icudtl.dat
        • Size 798KB
        • SHA256 65ea729083128dfce1c00726ba932b91aaaf5e48736b5644dd37478e5f2875ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        file_selector_windows_plugin.dll

        • Path C:\Program Files\GeekChat\file_selector_windows_plugin.dll
        • Size 101KB
        • SHA256 24fda26e9227d79c67c1c8075a82c13aa38f1002d0033e5a061ac86cb66fc614
        • MD5 SHA1 SHA512 SSDEEP TLSH

        flutter_windows.dll

        • Path C:\Program Files\GeekChat\flutter_windows.dll
        • Size 17.4MB
        • SHA256 ff53f8d6b4e75bb3404ef6d1864c08a9d7adfd37bebafb9741c11388f7cd6665
        • MD5 SHA1 SHA512 SSDEEP TLSH

        isar.dll

        • Path C:\Program Files\GeekChat\isar.dll
        • Size 1.1MB
        • SHA256 5e67863f188c5f9681a37f84f2eb942eaf702509d3f994c0344d5049ebc9e48f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        isar_flutter_libs_plugin.dll

        • Path C:\Program Files\GeekChat\isar_flutter_libs_plugin.dll
        • Size 76KB
        • SHA256 19b85ee99ccd7dcc707bcd6801b41f0cc2d39978f0dfb2da1f68dea3b334242e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        screen_retriever_plugin.dll

        • Path C:\Program Files\GeekChat\screen_retriever_plugin.dll
        • Size 96KB
        • SHA256 0feaedafa39382fbc5d78a9b28cbcb30db9fa2182988377984e2a809e84e1fe7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        url_launcher_windows_plugin.dll

        • Path C:\Program Files\GeekChat\url_launcher_windows_plugin.dll
        • Size 84KB
        • SHA256 95d9f703f5821abb117134bff5695bc19ee56242de4ce90d01ed7c6256423189
        • MD5 SHA1 SHA512 SSDEEP TLSH

        window_manager_plugin.dll

        • Path C:\Program Files\GeekChat\window_manager_plugin.dll
        • Size 135KB
        • SHA256 8c0ef834a6a12c1611936763c733ebf0b6e8a3f19ae8c6e0e0c3df8197097b9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        46e39924118a1bcb25a0e7c38399382de762dc60c2a60247bbf9472cb7241b37.tmp

        • Path C:\Users\Admin\AppData\Local\Temp\is-4D687.tmp\46e39924118a1bcb25a0e7c38399382de762dc60c2a60247bbf9472cb7241b37.tmp
        • Size 3.1MB
        • SHA256 47e8a90b9b525dd222b165dda61018af16d1029965ad0db16559f969d6a07f68
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2848-0-0x0000000000400000-0x00000000004D8000-memory.dmp

        memory/2848-230-0x0000000000400000-0x00000000004D8000-memory.dmp

        memory/2848-8-0x0000000000400000-0x00000000004D8000-memory.dmp

        memory/3904-224-0x000001F493F80000-0x000001F494BB5000-memory.dmp

        memory/3904-223-0x000001F493880000-0x000001F493881000-memory.dmp

        memory/3904-227-0x000001F493890000-0x000001F493891000-memory.dmp

        memory/3904-226-0x000001F493F80000-0x000001F494BB5000-memory.dmp

        memory/3904-225-0x000001F493F80000-0x000001F494BB5000-memory.dmp

        memory/5948-12-0x0000000000400000-0x000000000071C000-memory.dmp

        memory/5948-9-0x0000000000400000-0x000000000071C000-memory.dmp

        memory/5948-10-0x0000000002640000-0x0000000002641000-memory.dmp

        memory/5948-6-0x0000000002640000-0x0000000002641000-memory.dmp

        memory/5948-229-0x0000000000400000-0x000000000071C000-memory.dmp