b6cfc421c273d263d42662bd7a6ea4ad59b275a53246fd1bd00231c8c7774cb8

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b6cfc421c273d263d42662bd7a6ea4ad59b275a53246fd1bd00231c8c7774cb8.exe
Size 11.2MB
Sample260818-datkpsvzc1
SHA256 b6cfc421c273d263d42662bd7a6ea4ad59b275a53246fd1bd00231c8c7774cb8
MD5 321b189ad18b9a71208ca7d0fbfd1627
SHA1 da14f71e4933b287bf36e5902ecd19ff78d3e3e7
SHA512 2d63790f93dfcec1f39b2b968b7a118e5491515d87f5b923a842647c29cd5de36e1d30d69857ce9ad674ce6bd17ddbe9bdb54dc9fd188844108dc5253acbd1ea
SSDEEP 196608:0HYVCRfo1yJcsT5jUdfU4cNYe5GhUNkCxG1xmOD:TMB4yJH5R4cie5cCwmi
TLSH
T18EC6CF307BC285B5DEE792B6C5ACE62E4AEEFA900F3405D3914C17CE86706D21E365D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4456	YJSDmpServer.exe
2900	真封神纪元.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YJSDmpServer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	真封神纪元.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b6cfc421c273d263d42662bd7a6ea4ad59b275a53246fd1bd00231c8c7774cb8.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	b6cfc421c273d263d42662bd7a6ea4ad59b275a53246fd1bd00231c8c7774cb8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	b6cfc421c273d263d42662bd7a6ea4ad59b275a53246fd1bd00231c8c7774cb8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	b6cfc421c273d263d42662bd7a6ea4ad59b275a53246fd1bd00231c8c7774cb8.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4184	b6cfc421c273d263d42662bd7a6ea4ad59b275a53246fd1bd00231c8c7774cb8.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4184	b6cfc421c273d263d42662bd7a6ea4ad59b275a53246fd1bd00231c8c7774cb8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2900	真封神纪元.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4456	4184	b6cfc421c273d263d42662bd7a6ea4ad59b275a53246fd1bd00231c8c7774cb8.exe	89
PID 4184 wrote to memory of 2900	4184	b6cfc421c273d263d42662bd7a6ea4ad59b275a53246fd1bd00231c8c7774cb8.exe	90

C:\Users\Admin\AppData\Local\Temp\b6cfc421c273d263d42662bd7a6ea4ad59b275a53246fd1bd00231c8c7774cb8.exe
"C:\Users\Admin\AppData\Local\Temp\b6cfc421c273d263d42662bd7a6ea4ad59b275a53246fd1bd00231c8c7774cb8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Users\Admin\AppData\Local\Temp\YJSDmpServer.exe
  "C:\Users\Admin\AppData\Local\Temp\\YJSDmpServer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4456
- C:\Users\Admin\AppData\Local\Temp\真封神纪元.exe
  "C:\Users\Admin\AppData\Local\Temp\真封神纪元.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YJSDmpServer.exe

Path C:\Users\Admin\AppData\Local\Temp\YJSDmpServer.exe
Size 2.3MB
SHA256 0bbfb532f65d30c77ec9ca4e45d68d0897a10117d5138f0cfac46df762ef62f4
MD5 2bc977a331fed8335ad7560f28b22f36
SHA1 657d4fc7757be4ede87ae1e28cf0b2f408d96885
SHA512 8d8fd5ad04671a568c767a5ca5483abba1f9f29d74c403f193e4c9bd29ec8f1c9c4542ec3c63aaf8c6444b5f071635bed43614630afae96f85d05dc9348c8096
SSDEEP 49152:+CrXObwidtZD4s3MA7plm5OXurIUCeneGKIxpfXD73ocHLmkBRw09:ohjf311+FP3ocNBRwA
TLSH
T143B58D317E45C23ADDD702B2CA6CEA6F414DE9A40B3805D7D48C0BEEAA645D32F32597
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

真封神纪元.exe

Path C:\Users\Admin\AppData\Local\Temp\真封神纪元.exe
Size 1.4MB
SHA256 f8606736fb3be3a1791f29b96cecf488b2298a9e3d03f85fbcc2b098521696c7
MD5 12ded8564f43aa11f2e407f11f892410
SHA1 c65505c1272ef5541e4fb252435a916535a408ab
SHA512 05807bef2a95815b3210d448a100dad7e3fc60c9099a20c3be53c1e705d60332375494b725f2cbd660068107d953dbf3c438553354c07e353a75034120f33b09
SSDEEP 24576:Zdu5vgFkYZvT6D9fdqFgb2neiQTXYqaa4inqgjj3jiGjjjjdznCb6L0UkYr:bu5vgFkYKfdqFM2neiQTXnqonC2L0Ur
TLSH
T1F7655BC23561EE36C20D9BF17E01658A7581BC9CD3728AC3DC9E2E5B14660F04A7E5EB
MD5 SHA1 SHA512 SSDEEP TLSH