a079a744f8735c1451e3b83ac62b142ad17501da1aee6ba91816d9475ac0bcfb

Analysis

user interaction
yes
max time kernel
34s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chara.exe
Size 658KB
Sample260825-sa7vnatfph
SHA256 a079a744f8735c1451e3b83ac62b142ad17501da1aee6ba91816d9475ac0bcfb
MD5 4c7c53dac8b046cc086f34c4436b7694
SHA1 2e5ffc3d397e039538ba8deecf663ad07cdacd77
SHA512 d146ab2b2e39ff13ebd7486bf6ec92275f17aaaa701d3eb130f5512775282cb4cb83ca7c85b6aceac7cd65e37dc6961af8827b52b4b20af6255289d1e743d27f
SSDEEP 12288:xoGwEr4+Krccgiy9UbyzaTIZHynvo2w68/P4iF1a4t90sNFiOxVW2Fz+y3IC+nQ:a
TLSH
T170E40631E7B446C8F658553BD264C84B3AF14B27CAE361CC7586712B8B8FD24A9C8BC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (149) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
388	Chara.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
388	Chara.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	388	Chara.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 2272	388	Chara.exe	87
PID 2272 wrote to memory of 3980	2272	csc.exe	89

C:\Users\Admin\AppData\Local\Temp\Chara.exe
"C:\Users\Admin\AppData\Local\Temp\Chara.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4n3llqk2\4n3llqk2.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4419.tmp" "c:\Users\Admin\AppData\Local\Temp\4n3llqk2\CSC2C588A07A4A0475B91D181CC3C4A30B1.TMP"
    3⤵
    PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

4n3llqk2.dll

Path C:\Users\Admin\AppData\Local\Temp\4n3llqk2\4n3llqk2.dll
Size 3KB
SHA256 de677f3562c544b78413fb3278a357b7b983d04336a37f32f43c185e862c4574
MD5 5827463e87c71e13b77afa04b965096d
SHA1 060bb5faf049a0ec47deca753f71b1ce5424c8ac
SHA512 0a93fd338cc698c4a28d4b27728db2de7c7379a398043fa3e79d801e6f600462573023d6674ad1c4184d8bece5d26e2bfa3447189ba178cb6e28b10e6fea2d90
TLSH
T1BE51CB1693E8466BE4774B346DF3471637B8FC509B73672E48C00218ACA53645E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES4419.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4419.tmp
Size 1KB
SHA256 7c9d60e9adb013467269585aecf4a1b6cab8bb478e53efcd3f875c4231aa1649
MD5 98d652296136dc0777b7880b9b03e7c1
SHA1 82360001685d759f95205e80e483ec0129442564
SHA512 ffbc270f0919c114cdf9dc914edaa811ac777132d6c9332aad369141fd6a74b191892670e3dcc9d780e5234fe8cecafc72d36aba7ce899177d58c3ef4b8b9cce
TLSH
T127218C0583E8470FF07747317DFA136B9228FE95AF61976B894042281C51648EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ug5r2x50.51w.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ug5r2x50.51w.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

4n3llqk2.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4n3llqk2\4n3llqk2.0.cs
Size 289B
SHA256 653db0e789c211da9508812458c3ea646761b62760d19be2997d349c3673afee
MD5 2dfa104ea733fa32063cbb6924aeba42
SHA1 cea2e4784b912dded633afec82c803793b76290f
SHA512 8d866cd95d01648bda04819d6bc8acf72b73a3f448d9853836f4724dc83b50536fd5f85448f907d6b4089232fbb9444150c0b8150e36802b77613729cef11df2
TLSH
T128D0C2146AB2EA704033841A8C8BD0BEB70BA466266A19007AA51310EF8B00A8225A5A
MD5 SHA1 SHA512 TLSH

Submit Download

4n3llqk2.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4n3llqk2\4n3llqk2.cmdline
Size 369B
SHA256 ee63c262e50ec728cf8e9ce2dd384e65f949d2171ba8d4605edc1bbbaa8a18c3
MD5 05b1ddcab6ae7568e01ffbd6a33fa030
SHA1 1ba5473c495ca78c3b4aab32929b50e55cdf181e
SHA512 b44cac97227b77252a14f87a94ccefb37ea94a5ee5f52827d39259dd62568d52f3038275e739effb1d3dcc0442e8d6383b8148b3e983cd90b7f3b7dbe7ec87b5
TLSH
T1ABE0C63F4246C37D81ED104B227EC8ECCA7207833E803F84A8408C2EE2AB4003BD2799
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2C588A07A4A0475B91D181CC3C4A30B1.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\4n3llqk2\CSC2C588A07A4A0475B91D181CC3C4A30B1.TMP
Size 652B
SHA256 9b4aa446d17e1573889c25f8d89ab2397bec513fd34cf4c8a8d7de304ad38d98
MD5 074c0042a673b94859e6e1a1f61c57c3
SHA1 af30ce2fd1c1706341d9301391e821beddb18797
SHA512 0a28bc8de1550907a346accaf7f412403000f9091e1c18da07fdee4a9d4024d1cddb8804416d3abec282aa33059494dd95593eee4b1e558b4ca83cfbc6c0f20b
TLSH
T175F05E0963F8420EF4F38B30BDF643A391A8BD65DE72A7FD1484031928646149962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/388-0-0x0000000000800000-0x00000000008AA000-memory.dmp

Download

memory/388-8-0x000000001B460000-0x000000001B470000-memory.dmp

Download

memory/388-9-0x000000001B410000-0x000000001B432000-memory.dmp

Download

memory/388-22-0x0000000002A90000-0x0000000002A98000-memory.dmp

Download

memory/388-23-0x000000001B460000-0x000000001B470000-memory.dmp

Download