3d1734ebf94cc31c37cd9b2629b0761bc09f0704b96036c52fd1d147bc7f2b04

Analysis

user interaction
yes
max time kernel
92s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CB-Keygen.exe
Size 3.6MB
Sample260822-wx64esar8x
SHA256 3d1734ebf94cc31c37cd9b2629b0761bc09f0704b96036c52fd1d147bc7f2b04
MD5 238f840a3861c65c112e534738c31cb4
SHA1 86b4d28579475a184e4f153a09b0443990b90c48
SHA512 d5fba65d5f23369a2869b49ae725ea3badc7ffc3b667167ea9333ee59bd5b440cedd0f869703c35174bac129432ce867bbcb01fdec896adecb12253d5711447b
SSDEEP 98304:ppUl2sRt7kumew42ntouGBgYf6CdN1lakvCsaAap98ydW:ppVsRhmeetouGXjl53a598OW
TLSH
T1C806334277C28473D4212C3282A49952A73C68602F62C7E7A3D27E7D97716D2E672F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2672	CB_KG.exe
5968	ChessBaseAdminTool.exe

Loads dropped DLL 5 IoCs

pid	Process
5968	ChessBaseAdminTool.exe
5968	ChessBaseAdminTool.exe
5968	ChessBaseAdminTool.exe
5968	ChessBaseAdminTool.exe
5968	ChessBaseAdminTool.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5968	ChessBaseAdminTool.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CB-Keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CB_KG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ChessBaseAdminTool.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	CB-Keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	CB-Keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	ChessBaseAdminTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	CB-Keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	CB-Keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	CB-Keygen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	CB-Keygen.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5968	ChessBaseAdminTool.exe
5968	ChessBaseAdminTool.exe
5968	ChessBaseAdminTool.exe
5968	ChessBaseAdminTool.exe
5968	ChessBaseAdminTool.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2672	2980	CB-Keygen.exe	89
PID 2672 wrote to memory of 5968	2672	CB_KG.exe	90

C:\Users\Admin\AppData\Local\Temp\CB-Keygen.exe
"C:\Users\Admin\AppData\Local\Temp\CB-Keygen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\CB_KG.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\CB_KG.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\ChessBaseAdminTool.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ChessBaseAdminTool.exe" /ActivationOffline "3357147392"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:5968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CB_KG.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CB_KG.exe
Size 3.0MB
SHA256 3d00ef713f596b485e46f4cf103a4ca029df9940dbc89a831440a8063f1a66a8
MD5 5a9f0e83e1a6524ab7f6eacc314a5cba
SHA1 fbafbd248b31a3101c97fa1ea9897ef287febb50
SHA512 a2c14e66e65ddfcf4d67d5c6efccec44765216f8bcc78b7adb3461d8c3308a003400dfdd30a44f1e265f86ed7de12e13066b156a1275a111bd9a16459387fa1d
SSDEEP 49152:3k/V4RiIyxZknJdCMwbAgi4a3j7rTPW3xS7zIyCXyzF1mk5nA+fhB:mV4Ri/eCMDb4a3LTqxS7zIjy58k
TLSH
T1DCE51A2177128127D9630AB1DA4D86E94664EE242F30E5C731C87EAD6F73BD63E39321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChessBaseAdminTool.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ChessBaseAdminTool.exe
Size 1.1MB
SHA256 35e2d701db72f1780e49ca22f517e15e023a4bd408ecbe877a34f6fa2ac0bd82
MD5 16cd9ecdddecc4ba7f4b89db2401439d
SHA1 f747f0c4686a54e9fd79641413a87ba7112e078b
SHA512 285c1fb3f0f254e9b10bd8f7b5947a6f7def14e388c79b58f1ad2f610247354474e77564d65fda680b0b943759edbe8472dec88b9904542dff7070a0099128ee
SSDEEP 24576:Jgyu4g+N9DXlOjyd5gfcAHnmWpbf9+Myuu7hl:myzF1mk5nA+fhl
TLSH
T1B0453B213A01C037EA660971FE5CCAFE4029AD744F6155DB6288B79D1F777E22E3063A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\MSVCP140.dll
Size 426KB
SHA256 885a0a146a83b0d5a19b88c4eb6372b648cfaed817bd31d8cd3fb91313dea13d
MD5 c092885ea11bd80d35cb55c7d488f1e2
SHA1 bfe2f5141af49724a54c838b9a9cb6e54c4a6aa5
SHA512 8a600ccf97a6d5201bb791a43f16cd4ccd19a8e9decae79b8ba3e5200b6e8936649626112b1c6bdb1465ab8afb395803a68286c76b817245c6077d0536d03344
SSDEEP 12288:mgU0BGzePo6+J+4P0xYv7IQgihUgiW6QR7t5s03Ooc8dHkC2esMoWKl:I01Po6+J+dxYv7IQgR03Ooc8dHkC2e50
TLSH
T113943932BB464DF1E48913B971C9472193F9FC610362E3C397DAF12A2F566C6A633A50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Countries.inc

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Messages\Countries.inc
Size 4KB
SHA256 a1ff5302b95a293433f77db64b40f04a2bd6706521cf0a8702991d88378b015c
MD5 200710201c95f4e8a612299b132289da
SHA1 fee053ea657fd46f68799915c98ae522bbd27f3a
SHA512 b927519a5b208cff59e2aca057e7b1f07a5bb57db5d92cc231736655575e07caf5480773979304d9bf1c1a73534c75f18d4cb88b696b3da8d8dc19690c28d19f
SSDEEP 48:6DRLCGoICmUiMQlIY3oGb+ggoAY9uruFp3FQ1McxmFipvha5VpbMJPJdHU6iSvtH:axIIr0qoGMYwruFp18M8ppGMNJBZ9
TLSH
T197A174FCC416AEC01939D5E026B746A04A1F28DD6AF0439D5E9B8C40D6EF0BB34A47E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Countries.strings

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Messages\English\Countries.strings
Size 16KB
SHA256 c52a78c82f7eedd0ce5be7bc678837496632c9dfd53a965e29f90d4367c8d211
MD5 90b850c19bdfda9a852a786878b31cb0
SHA1 921bf27a3d73d13df43687966fdaf6f0c264c6f6
SHA512 2f82014c3fd8eb4724e8c24dbfde96dfedc7d3b7ee5aa708c25690fafe7094dad956ab51adacaad56a1644643de7dc746ce373442ba88721208faac06262be37
SSDEEP 192:8f1hG73y34hjsasGvm0Vq1trUJl75yuKv/vUl0PX0IvzGCjFH3RPtjMqnxmMHrdY:8dxIhjbHyuKclonvz1tm
TLSH
T178720DE9C8155D234698D52048B27E07151F01AF45A8F78D79AE1E4CEBEF47E21A02FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Frame.strings

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Messages\English\Frame.strings
Size 378KB
SHA256 c304df5ed37ee370e0920bed1a6e5dfb64c643e15ca684302eebdedada05e117
MD5 dff64d178593fb1eec98072664f04268
SHA1 952f52c3b712c439b978565d9b28c4af058fddd8
SHA512 8b3f80b25a8c5330a08d21f78e7c1fc16dc019c737f5a684353faef2c6c66dd062db8b14c067e334a6409769082b8ef4f33f794d2cb15597aa11331ea9982189
SSDEEP 6144:NEg8Ge14MIJ+2D7N1ig1k4h65k/NkFGzAjrUsEoP0rs9fismkdOVDQ5ZEn5UbryZ:B5xf
TLSH
T1FD84F72CC91A5F2309D6C3A518D7ADD270A542AAD714DABD3C2C520D23ED53C33EA7E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Frame.inc

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Messages\Frame.inc
Size 111KB
SHA256 0f0fee1920a1e76090cb405a08b3112c256bcc2f461a302ae56ae9b4a8dc05c0
MD5 9710429dff75d90e6f6073b2b851b266
SHA1 4647900778bce35d05322cd04005af8a4e9baf97
SHA512 c9935d00d6cc139f4f483d824b8ce694c6130770a94e2dbf1ea2cd44c8f8a9b1a21e2cac3eda502606c84e00dbb72ea3a8de512843be0a6a8e3d61b4a0937f1a
SSDEEP 1536:XP0vE4Xl9Wmu0cT3gbWyPKkICz79nzuGjY0fkheerQNRSk:fwamdcT3gblLuQn/
TLSH
T125B3437CE9AB7A94AD2B8CD860F364C51015248AFDECE6B64433045118A9235737BFFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SView3.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\SView3.dll
Size 1.3MB
SHA256 637db60b09fa3915cd1f7b5e6bbe47a70f10e0447d413ac2069721169ca2aa85
MD5 45df078f681c5070810d316c4c67d82a
SHA1 0895d0a981b1505861a1ad3a83a58edbf1041f70
SHA512 a3519058a5aa8bb9d802d63c7472bce80a184a0d9c7b9b5e5c0acadd2dda540a81214d82a687950dba0835ab4ef652185b5d462bf505f432b938348b235a1e9a
SSDEEP 24576:g9vLnm7nOP1J4I9HrF60bavoUTJr4ipDBu1:ILnm7nOh9HfUTh4UD
TLSH
T10B555B303922C67BDADD93F19D3C69AF202CA5680B7442CBE39C0D2A2C755D39B36657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\VCRUNTIME140.dll
Size 74KB
SHA256 1e0f8f7f13502f5cee17232e9bebca7b44dd6ec29f1842bb61033044c65b2bbf
MD5 31ce620cb32ac950d31e019e67efc638
SHA1 eaf02a203bc11d593a1adb74c246f7a613e8ef09
SHA512 603e8dceda4cb5b3317020e71f1951d01ace045468eaf118b422f4f44b8b6b2794f5002ea2e3fe9107c222e4cb55b932ed0d897a1871976d75f8ee10d5d12374
SSDEEP 1536:O6HuqvERNjBwySXtVaSvrgOFw9RxKMnMecbCIdFr:O6HZMRNjKySdLcOiHMecbCId
TLSH
T173739E4278C08272D1BE0A79057AF612673DAA200FD15FDB7FD85988AB75AC0EF31213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc140.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\mfc140.dll
Size 4.6MB
SHA256 6e668acf6f4fc3fbed14c89cfa80ae38e49b09ac9035df698c191a217c6d0bc0
MD5 c594917d6c51b6696caa3c707bc435bf
SHA1 2189fd825d6fedab393c7ee12dc9e48283b14f0f
SHA512 759635629b5b9ba8ab11812fa4b60a22b2745b289482b12f60ad2581ef8cdc826f1062fa58d6c1fb9ec9ee6606e374e2f6a23992fb72ee20a6c8850db5f7c8d1
SSDEEP 98304:PibXcsa0ZQcMJ648MkqhJhM4q5Y9+09c+4gpdhCV7FLOAkGkzdnEVomFHKnPm:azctwAg8kL5b0y+4gpdhC9FLOyomFHKu
TLSH
T1B7269E107D4A00B5E88E1431EE6CA7B5EB6EDC25173901D7E135FE9AE5B13C20E362A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2672-30-0x00000000005BB000-0x00000000005BC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads