552d4729428664d76dbd2aa2bce64db9ad9a923ac4be3209f3c76064e5aac095

Analysis

user interaction
yes
max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MuMu_6.0.2_UkgnKbC.exe
Size 5.8MB
Sample260820-2amddsbn7t
SHA256 552d4729428664d76dbd2aa2bce64db9ad9a923ac4be3209f3c76064e5aac095
MD5 5cebb5b671a423443563bbd50f9b151f
SHA1 358e5d0850f4c90b7cef957c01d6e09bba4ad7c8
SHA512 b6d38616843f59a80121a98f9838b65c38f59bf1f1fb109691de54866cef5f6acd053069591a1bde1fa77483eb580a0b178306792d2727bf9388ba0e445a62c1
SSDEEP 98304:Fer6uFFkOuPZ3cja1XAY8Qm/gPeX7ZmKdlhqap1ZcWDtIELv9VCOxeI+S0bIwrSV:Yr6uFFkOuPeaF9787ZHlLbjXLWjI+Svn
TLSH
T120562382C20173B6D41D5DFC512D87F6BA537CDE6C582D46028EF2ABB0AD5602F849DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
54	4320	MuMuDownloader.exe
60	4320	MuMuDownloader.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	nemu-downloader.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	nemu-downloader.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Netease\MuMuPlayer\1.txt	nemu-downloader.exe

Executes dropped EXE 7 IoCs

pid	Process
3316	nemu-downloader.exe
2864	crashpad_handler.exe
2632	ColaBoxChecker.exe
3756	HyperVChecker.exe
3408	HyperVChecker.exe
1540	HyperVChecker.exe
4320	MuMuDownloader.exe

Loads dropped DLL 5 IoCs

pid	Process
3316	nemu-downloader.exe
3316	nemu-downloader.exe
3316	nemu-downloader.exe
2864	crashpad_handler.exe
2864	crashpad_handler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MuMu_6.0.2_UkgnKbC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nemu-downloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColaBoxChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MuMuDownloader.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3316	nemu-downloader.exe
3316	nemu-downloader.exe
3316	nemu-downloader.exe
3316	nemu-downloader.exe
3316	nemu-downloader.exe
3316	nemu-downloader.exe
3316	nemu-downloader.exe
3316	nemu-downloader.exe
3316	nemu-downloader.exe
3316	nemu-downloader.exe
3316	nemu-downloader.exe
3316	nemu-downloader.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 3316	1140	MuMu_6.0.2_UkgnKbC.exe	85
PID 3316 wrote to memory of 2864	3316	nemu-downloader.exe	87
PID 3316 wrote to memory of 2632	3316	nemu-downloader.exe	88
PID 3316 wrote to memory of 3756	3316	nemu-downloader.exe	92
PID 3316 wrote to memory of 3408	3316	nemu-downloader.exe	94
PID 3316 wrote to memory of 1540	3316	nemu-downloader.exe	96
PID 3316 wrote to memory of 4320	3316	nemu-downloader.exe	100

C:\Users\Admin\AppData\Local\Temp\MuMu_6.0.2_UkgnKbC.exe
"C:\Users\Admin\AppData\Local\Temp\MuMu_6.0.2_UkgnKbC.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\7z8058A474\nemu-downloader.exe
  C:\Users\Admin\AppData\Local\Temp\7z8058A474\nemu-downloader.exe
  2⤵
  - Enumerates connected drives
  - Checks computer location settings
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Users\Admin\AppData\Local\Temp\7z8058A474\crashpad_handler.exe
    C:\Users\Admin\AppData\Local\Temp\7z8058A474\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --metrics-dir=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --url=https://sentry.netease.com:443/api/325/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=d7282c50f1b64296835edf7d19667322 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\92cad769-0f56-4bc9-ed9a-fced946315a3.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\92cad769-0f56-4bc9-ed9a-fced946315a3.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\92cad769-0f56-4bc9-ed9a-fced946315a3.run\__sentry-breadcrumb2 --initial-client-data=0x334,0x338,0x33c,0x310,0x340,0x74da4800,0x74da4818,0x74da4828
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2864
- - C:\Users\Admin\AppData\Local\Temp\7z8058A474\ColaBoxChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z8058A474\ColaBoxChecker.exe" checker /baseboard
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2632
- - C:\Users\Admin\AppData\Local\Temp\7z8058A474\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z8058A474\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:3756
- - C:\Users\Admin\AppData\Local\Temp\7z8058A474\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z8058A474\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:3408
- - C:\Users\Admin\AppData\Local\Temp\7z8058A474\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z8058A474\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\7z8058A474\MuMuDownloader.exe
    "C:\Users\Admin\AppData\Local\Temp\7z8058A474\MuMuDownloader.exe" --log="C:\Users\Admin\AppData\Local\Temp\nemu-downloader-aria.log" --log-level=notice --check-certificate=false --enable-rpc=true --rpc-listen-port=49993 --continue --max-concurrent-downloads=10 --max-connection-per-server=5 --async-dns=false --file-allocation=trunc --enable-mmap=true --connect-timeout=5 --rpc-max-request-size=1024M --rpc-secret=MuMuDownloader1,787,264,640 --stop-with-process=3316
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ColaBoxChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\7z8058A474\ColaBoxChecker.exe
Size 4.0MB
SHA256 65aa91ee18b46603a5543fdd398d6331a9f77eb8a16a6933f2fe576fc62d6941
MD5 a6d0d421e32946a34de15e4e397ec0b0
SHA1 bc15a70e4d1f9815cfe8d2532d447f0702bb18f0
SHA512 b7817f72fabbf2017d91d48765b2bba83f784d7e02107695f8a7584f8834a12b0a745688d3cbede795b14afe7de4007442f8c96fcc0059b2af309c1ea1493e43
SSDEEP 49152:1gP8dFBouKaau2VgFLTeJxx8IHqQOPclSWkar66Dv4TpN1KjH304dAHRvOA:WP8dFuudB0gFLQ2QOQ660TpN1eX3dC
TLSH
T1DB167D31370BC135FF8281B7456DABAB437C8A650B7340DB92D42BBAD9352E22B35D52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HyperVChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\7z8058A474\HyperVChecker.exe
Size 118KB
SHA256 d545ed2dfc015f965d35dc4950fe773cb94103a685d3c25c4b44fcb466a85662
MD5 ba1dd89be69ee0e03af11d90785b5b00
SHA1 8d46e63b0b9635ebcf79ab46093832dc4936b800
SHA512 ca33b083b717c2cb1f40fe6eb96b52b71ede808c1d09c782d659aa7ab6034fa612326f17ad4db0b8ed9f1ae2e8633db54f89ea95536a856f338dfe3286e9d6f7
SSDEEP 3072:0wLn2WoLPivTkgxUJ8UrtmMx7bB5dSUo+WziN:Jn2WoLP++J8Upo+WM
TLSH
T193C37D57A3E434F9E17B9638C8910A49DB72B87207609FAF03A442961F637D25D3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MuMuDownloader.exe

Path C:\Users\Admin\AppData\Local\Temp\7z8058A474\MuMuDownloader.exe
Size 5.7MB
SHA256 7b3463c16416c93d9b8b47c71f74844546b56b6d7a482d6e339fc94081658a3c
MD5 7e556e4d9729dc07838dcb5fa8ed70a2
SHA1 af73dbec7c246d45c7a0484ee25bf1da9bcee9d9
SHA512 6eaf263a8cef310fe24d8b9b90562e5f7e0fea2013e02bddf020e2c1a5e9617d381f463cc7da3e5d7b55c6e07ad291a121b98fe016245ec8b92dd62f91a2d873
SSDEEP 98304:tkGkHBfhGbdvHp+PTwHbQApPCNmQ5U7dI/v4GW/F/P9w9Teai3qAiaOdH3qXYFES:tvkhfO/7QyOU7XGW/F/P9w9xiXGqXCdn
TLSH
T164567D59EE8314F1FA2351B1818FE7BF96246B128021EDBBFF4ED949F7336112909216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baseboard

Path C:\Users\Admin\AppData\Local\Temp\7z8058A474\baseboard
Size 115B
SHA256 7185961fbae71a0ea89ea3d968f74a3bc998a67fae48a5fc5cd9b0f5690f48fb
MD5 31cb5ac285d8e7b037485badc1245cfd
SHA1 293c5dddf1c41acb750a48f6e3f8f0e6a6036b77
SHA512 182ce20f7b88b512adf9de79c4b64389883998c55b271822ab1b62caa42c7dc71e2a87ac9cc5b20d806dd4a16daf2534fd03b20261bab20d57216dc449d7520d
TLSH
T160B01239E0D32C07C45B440404BA859239204DB38B056C703719057C0B8C4EA2EDB9CC
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\7z8058A474\config.ini
Size 346B
SHA256 ea42cc69fdcc0b4f48be92a44aea54e86aa411a133120496ea307770c2fa8eef
MD5 2c19a90fdb8b51e9b52466f172f5c6ae
SHA1 066de31c14ad1d7ad327eb6f80b810f1c88ea708
SHA512 310a8ed4658a7a40f8d00c89020f13de0e82188d8e05b350a34cb7053fc2d999f336c4b8024b66355f1a9f46a4b64003c61b1c7be210db37ba749344229ee053
TLSH
T1B8E0127D56228A16B6107FCD254B3311AD3AF1F37E418490EB28A5B2B933D66D62380B
MD5 SHA1 SHA512 TLSH

Submit Download

crashpad_handler.exe

Path C:\Users\Admin\AppData\Local\Temp\7z8058A474\crashpad_handler.exe
Size 542KB
SHA256 9769c585019a1a19d96dc0f378bd90240015a54ba77288b2efc995f791a49bc0
MD5 9ba1e7d7bfce0e9e0d52f33ef5e01e91
SHA1 5e301c6d74602e30ecabd1e445dc334440b2e07c
SHA512 aeb4c76a23bf8664c140035491f3747a6a39b4f118dd12177e5b0aff021d33ff7a3903af22dc37cb350e582ca94dcdc6d64cb204c11f50b2caa7acf643dae00e
SSDEEP 12288:reAQnPupDjbkEW1b4uifVysTVRAtCX/BJ2LoUG3zi8SrcOTFJMjlgPrdhfbTh0aI:reAQn2ptXX5J6Gj/SrcOTFJMjlgPrdhW
TLSH
T12CC48D707A2AC136D25291F15C59EBF790AC991A4B7308C3B3C95B396A712D32F32937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\7z8058A474\msvcp140.dll
Size 427KB
SHA256 8acd9e63a83f2facfc68b801f864f923eac5fb8c8a046a32fef8d622ba7d407f
MD5 77e799e61066dfb983babee530e22fd1
SHA1 659484995b44b5d6e7d22d52abbfa2f68e27d32e
SHA512 e942da491509ce781abc2ea099fea110df076d264053b92a836428fcae82e29e07351f6678aa884ec26dd12230c864d3bfbd1058ecc94c89baa0cd5dd1826744
SSDEEP 12288:+LxU+0XySH2CyKSPRBb22umby6hUgiW6QR7t5s03Ooc8dHkC2eskI4j:wxUwSH2CyKaBb22umb203Ooc8dHkC2e7
TLSH
T121943932BB460DF1E48913B971C9472193FAFC610362E3C397DAF1262F566C6A633A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nemu-downloader.exe

Path C:\Users\Admin\AppData\Local\Temp\7z8058A474\nemu-downloader.exe
Size 3.5MB
SHA256 fcdc71d87b45e68563c3d7314ea9e1206fde435b0809672e02228c459a3d05fa
MD5 f516659c89ec32c53bcaa306bbe5506b
SHA1 ef071b672dd65061aec4202271fdb0eb5ac1209d
SHA512 e66bcaf6139942595420c7d4d8fe943e20f5e2169260a7f74c7b9dbb9713f1dbb76d0c8ecd31222e58b04f84724fe55ee35f8c5ab409d13137a0a36d0d55fc1f
SSDEEP 98304:GVD1Frr2P0Ra9ibVv0Y34ulPLPqeBopVbqsNfaprVB9bNcl16uFFkOuPXdK:G7Frr2wa9CVv9IRVbqsNfapB46uFFkOR
TLSH
T1DC067B05B691913AFAF305BA89BD465E443D7E310B28C0C793C45A5F2BB6DD23A31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sentry.dll

Path C:\Users\Admin\AppData\Local\Temp\7z8058A474\sentry.dll
Size 223KB
SHA256 2e108ccbbd47997978512835013d06500bef5575f29cb937f623d30596662819
MD5 2c886b7927c0748042a5e294fba28e52
SHA1 8f4723d26f334f98349e237fb58e6df7791c24fe
SHA512 2667bca82d042cbb0f8d1140ee74efdd8e7d4e81881b7ecee337ea03506533055c382f176ee34ece15245584163d7ff3c796a1612cf5b38d060d6dcabe387c7a
SSDEEP 6144:BzEuxVrnhbnA4bWqkr3hRpR31HoXr4cDfSNEaFDRXtJ:BzfxVrnhbAVFVKX8SfSNEaFldJ
TLSH
T139248EA13715CE7ED79F03F4A8FB6BBB853951190B7285C3E3492F6856310C22B3661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\7z8058A474\skin.zip
Size 398KB
SHA256 aa40840b724a3c1e1d2d567b7b03b077bbd813268224273511826c5bd4454c10
MD5 d5a974d94c01a270a6f3d5816d2417bf
SHA1 4afe596d9d62b539e861dc66ef963198e320d386
SHA512 9e53dccd2a240985efccb85962a76ac1a07a2260e03171cf02058e7fe362b7efaea7eb0f7860cd8b0109e9a6f60ced7ff6e211108b7ce981cfc3039e730e4d2d
SSDEEP 6144:kRsoSTx0vEyyfDRqwg/d1SQC+HxzG96e3Pi1GG1x8ZFE7gI8L:csfDLpg/d5CAD8jE7gFL
TLSH
T19A8412DFF721A08AC69FA778510700526D3E5897C531BB4A1CB248645BCFEF406AA39F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\7z8058A474\vcruntime140.dll
Size 75KB
SHA256 526d8774c67248aa62a5911acd7db667cc4bed5be2cd5dc139c6c4d5dfb9d57e
MD5 dff7397268e74ff615529032a9af2ccb
SHA1 68a671e4634825684494e45d7724a64b5146b3eb
SHA512 c0928d3c0e997bcc082530ff565569267f9e307f45f796a0f62c76f66c6121674d87123af19993f2b9f40dd7f059d1ded51c29d5d11b8dc47802cc83690e6d0f
SSDEEP 1536:c6H1qvERANBw6qntn64lqVwhNDyUZXRqtnHEecbCBg6yzT:c6HMMRANK6qtnsVON7JYkecbCBQ
TLSH
T1FE739E5274C48272C5AE4AB9017AF612663DAA604FD15FDB7FD8598C9B79BC0EF30203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4320-159-0x0000000000C20000-0x00000000011D5000-memory.dmp

Download

memory/4320-160-0x0000000000C20000-0x00000000011D5000-memory.dmp

Download

memory/4320-163-0x0000000000C20000-0x00000000011D5000-memory.dmp

Download

memory/4320-172-0x0000000000C20000-0x00000000011D5000-memory.dmp

Download