5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
Size 5.0MB
Sample260814-fxvsdsv1ev
SHA256 5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879
MD5 f195ab1e412b2c13f3a2cb8dd4fd7b75
SHA1 4ace5de4e3fdbca212234289c9de0d979137978c
SHA512 f4a090d1db6c722d50db01f819c6487d43573c85b3621d22ec2ff19321e22937d2bebd462a787c0188a52edd6789d64d799e77e3a058a0c851e96792cb139364
SSDEEP 98304:P+CZMFS6HibR9/NmXHQF910aNW0Rd1izDicykqXf0FniE+wDl:P+YE29/NOS1e0RdM6cykSInawh
TLSH
T1E436D013B394643EC06B1B3A5827D751993BBA612A2B8D8B97F44C4C9F357403E3A787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\ForceConnect\Guna.UI2.dll	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File created	C:\Program Files (x86)\ForceConnect\Fonts\MADSecurity.ttf	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File opened for modification	C:\Program Files (x86)\ForceConnect\Fonts\MADSecurity.ttf	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File created	C:\Program Files (x86)\ForceConnect\Guna.UI2.dll	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File opened for modification	C:\Program Files (x86)\ForceConnect\Newtonsoft.Json.dll	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File created	C:\Program Files (x86)\ForceConnect\Newtonsoft.Json.xml	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File created	C:\Program Files (x86)\ForceConnect\ForceConnect.exe	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File created	C:\Program Files (x86)\ForceConnect\ForceConnect.exe.config	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File opened for modification	C:\Program Files (x86)\ForceConnect\ForceConnect.exe.config	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File created	C:\Program Files (x86)\ForceConnect\Uninstall.ini	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File created	C:\Program Files (x86)\ForceConnect\ForceConnect.pdb	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File created	C:\Program Files (x86)\ForceConnect\Newtonsoft.Json.dll	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File opened for modification	C:\Program Files (x86)\ForceConnect\Newtonsoft.Json.xml	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File created	C:\Program Files (x86)\ForceConnect\Uninstall.exe	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File created	C:\Program Files (x86)\ForceConnect\Fonts\JetBrainsMono-Bold.ttf	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File opened for modification	C:\Program Files (x86)\ForceConnect\Fonts\JetBrainsMono-Bold.ttf	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File opened for modification	C:\Program Files (x86)\ForceConnect\ForceConnect.exe	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
File opened for modification	C:\Program Files (x86)\ForceConnect\ForceConnect.pdb	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe

C:\Users\Admin\AppData\Local\Temp\5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe
"C:\Users\Admin\AppData\Local\Temp\5e99f8404133fbef9b86600881d5b92f032f896a7e3d88b76667c60d96db7879.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3140-0-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

Download

memory/3140-26-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

Download

memory/3140-25-0x0000000000B00000-0x0000000000E03000-memory.dmp

Download

memory/3140-35-0x0000000000B00000-0x0000000000E03000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads