e977d9019638f1d22d1dacf3d452191626a89b767bb5bf3fe59a2fb1fec8fb73

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 14:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chara.exe
Size 811KB
Sample260825-r6f65stepd
SHA256 e977d9019638f1d22d1dacf3d452191626a89b767bb5bf3fe59a2fb1fec8fb73
MD5 3da4bea33b46c428f943fd284a678549
SHA1 8479c6a27c13fad56f93eb5cde7cb95e013ce94f
SHA512 737d08e6d11532d7c5b9594a4b54f64d569ab6b434aeec91bf7b6fee8dc4135d1b5f1bf42a354c840ebf0cebb4cf7fa1e7abd001d74853411b72abb62800877d
SSDEEP 3072:z0lY8Q5gvsczGcP5wIA1s7rgqGBobXexJi1S878FweHu/bFMpl9zb8YS16DcY9eq:Ix8rqGBoDsJi1S878FJuk9z06sdOQFi
TLSH
T17E0539A0F72DB0B2FA740A3E22C3CC9F7AD0651A5DE6356474499A3F9B7218059CD3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (110) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1296	Chara.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1296	Chara.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1296	Chara.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 416	1296	Chara.exe	85
PID 416 wrote to memory of 3724	416	csc.exe	87

C:\Users\Admin\AppData\Local\Temp\Chara.exe
"C:\Users\Admin\AppData\Local\Temp\Chara.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0umlcyhe\0umlcyhe.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5A12.tmp" "c:\Users\Admin\AppData\Local\Temp\0umlcyhe\CSC3C02AC8CE5BD4590A81D4ADAF053686E.TMP"
    3⤵
    PID:3724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

0umlcyhe.dll

Path C:\Users\Admin\AppData\Local\Temp\0umlcyhe\0umlcyhe.dll
Size 3KB
SHA256 425808708809ac4aa21b4e47e8ca18e4cb4c8168c7774f1025bc01f7c2928f4f
MD5 058c8bcd77602f0d2688d5708add1f0d
SHA1 aa665baa8c4d8025872cb489bf34509eda3b5c7b
SHA512 a292cbdeac12b67adc44686a665560cca794024a6831f5577ec43f2d634fd073cf4c144329b7f2168ddfd105dc7f86269d682964c30c728502abf303441da5cb
TLSH
T12651CB1793E8466BE4770B30ADF3471A37B8FC549F73631E48800218ACA57545E32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES5A12.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5A12.tmp
Size 1KB
SHA256 60def0baaa1121468c5adfbc68fe6535ff1d8ef85238ba0bcc10fc3e1f34670e
MD5 59308a79a22ecaeb984aa75634f883ef
SHA1 6ce4ac90d9e115f381304ceb8103f8ecda0aa237
SHA512 6e898df4b1b41db60a1fb55cc27b3d99e6d6be3c959fae1fc15b8bf952d67d99985c8785760739d5ed323d3e7795a1cb9435c1359379a2d3da7a16762948d965
TLSH
T15E21C90153EC470AF0730731ADF6132FA634FD99EF62935E844052281C91544EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_g1ibv322.hgp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g1ibv322.hgp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

0umlcyhe.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\0umlcyhe\0umlcyhe.0.cs
Size 289B
SHA256 653db0e789c211da9508812458c3ea646761b62760d19be2997d349c3673afee
MD5 2dfa104ea733fa32063cbb6924aeba42
SHA1 cea2e4784b912dded633afec82c803793b76290f
SHA512 8d866cd95d01648bda04819d6bc8acf72b73a3f448d9853836f4724dc83b50536fd5f85448f907d6b4089232fbb9444150c0b8150e36802b77613729cef11df2
TLSH
T128D0C2146AB2EA704033841A8C8BD0BEB70BA466266A19007AA51310EF8B00A8225A5A
MD5 SHA1 SHA512 TLSH

Submit Download

0umlcyhe.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\0umlcyhe\0umlcyhe.cmdline
Size 369B
SHA256 a04156b1d96fa17d22007f9f80abc495a42352883cf61e5001def6d04e4f337a
MD5 35785477653409dd0346a8e76613507a
SHA1 7d7f7054cf5b60f491e8f8942cb6202946f85d3c
SHA512 a93dd2b3d751b0ef9e8d84d75e62b71f5c718eecc3d178af0f3c5b37d6147097c964583f56cf31d589d4dae0eaa8b06b5361aa9c4d34dab35df59a4b816f9768
TLSH
T117E0C02A424EC2FDC1DD104769A9C4BCCB720F872A403F845840840ED0171406FF27C9
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3C02AC8CE5BD4590A81D4ADAF053686E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\0umlcyhe\CSC3C02AC8CE5BD4590A81D4ADAF053686E.TMP
Size 652B
SHA256 f8f7909c9f80fd0874ae74e1814a16308657df48f3395b3a1c59dfb3e4a59b1b
MD5 c962ad90c21ba085acadc89633012a53
SHA1 dd4a0471a78abb7fa72b26c142bf3c4879a95a6d
SHA512 ce57c8550c9f0e3cd2136e44d402eaf0531e1f5a376aea65216838041ad717e7473837fc471b8a7dcde848b7a81b17b83c19246f8411b518d58a60cc1a1516a7
TLSH
T194F05E0A63FC020EF0F34B70BDF6836395A9BC65DE3293ED544003192C649108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1296-0-0x0000000000600000-0x00000000006D0000-memory.dmp

Download

memory/1296-8-0x000000001D3F0000-0x000000001D400000-memory.dmp

Download

memory/1296-9-0x000000001D380000-0x000000001D3A2000-memory.dmp

Download

memory/1296-22-0x000000001D370000-0x000000001D378000-memory.dmp

Download

memory/1296-23-0x000000001D3F0000-0x000000001D400000-memory.dmp

Download