Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 08:40
Behavioral task
behavioral1
Sample
HowToFishTrainer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
HowToFishTrainer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target HowToFishTrainer.exe
- Size 9.3MB
- Sample260831-klbbtsfp9w
- SHA256 d4def4e6531100da3216d754f80b732a7c9f94e1676edb931e492a31525bc44d
- MD5 2d03a03a91b1228273819e7ff2debb0a
- SHA1 9846330cd96f8a7be6c2ff9f95c94339261e4877
- SHA512 74c372c6f410edde5ac25003d1f225d75f12ef43c5fd55bc8c20d583e777595fda25eed1b1dbddd584565823a54b058e202c11cbdbcd38f5094e7e275c69f798
- SSDEEP 196608:g/pWZtbW897GTPHMe81SF2RPUewYttKZ2lmHLF2d+C:qE1SPsZg2KepK4lmrZC
- TLSH T196A63359979408AED867DD3F8869C272D3B2B83597A0C0CF0BE08B163F471E96C7A745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 15 IoCs
pid Process 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe 1480 HowToFishTrainer.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1480 HowToFishTrainer.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4960 wrote to memory of 1480 4960 HowToFishTrainer.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\HowToFishTrainer.exe"C:\Users\Admin\AppData\Local\Temp\HowToFishTrainer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\HowToFishTrainer.exe"C:\Users\Admin\AppData\Local\Temp\HowToFishTrainer.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1480
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013602\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013602\VCRUNTIME140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
- MD5 c0c0b4c611561f94798b62eb43097722
- SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
- SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
- SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
- TLSH T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013602\_bz2.pyd
- Size 85KB
- SHA256 082a761a280b08afecf6fb0509050ffbf7e87d1638ca49466b8b3eb4c85009b4
- MD5 b831ff0ab5f28a1f3bae6842896d45ff
- SHA1 e96c4dc15ef8f55fa47eef0f5e3d4a184eeef764
- SHA512 bdac51598e349a96aa399f8d6fc6ed46b8ff797bb70b372290a941581f4b63318df9578a557a297873b827b2de2eec8cc14e3c1241cf65f3e71f5653d7b034da
- SSDEEP 1536:jGNqB8z7DyEXkmNf0/ixk+x5dxNkP88l3ub8zMDIGQIS3VvcycA89JfIYhE:CNqB8zSEJUoZlTkUGK8zJGQIS3VLV
- TLSH T189838D86F36552B6F99FD1B846840793F734BB860750A3AFF148829A3F13BD06E5C225
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013602\_ctypes.pyd
- Size 139KB
- SHA256 a11d680d89f054584e6a5b2a03103d8731def86e367aff2f70cce8c6367f9025
- MD5 208e7dd066f23080da03b4ebd20fbc43
- SHA1 8b56760b26be7c98a6752cacb3e78716972089ba
- SHA512 7841d4a3d6b04d00eff9e6a7ebdffea6d5a257bc095bfdfe33ffe78f2d0ce731af5021206b8e3b2e0da5ab0a27b0a65d149c346ea6c1d95fdd75087a411de40f
- SSDEEP 3072:7Eyf/PRau5nIktyc7utl1OUIVi0I1sDdMIBU8ISGPiT:oy35aynVp0qUITGs7BUS
- TLSH T146D37E0B736440E6DAA78178C6739E57EBB1F0511A1087CF4264C9AB2F633A26E3F715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013602\_hashlib.pyd
- Size 67KB
- SHA256 0c11671a2c572b4c016be263789f238125419df5711e281acdce8da50d9badda
- MD5 4f7f664e8558a6cfc93ede2ae9d6974a
- SHA1 0b5ed2b9c68120d5912f12c1d6038afe517547a1
- SHA512 89cc41406f4b3da7ea46e15e12f86135ffe8c3fa2d906c8aa370402cfa4bd67fa00e2901e33e3e44daed075ddb9ac35c4dfd3181c44544d17c97522363227b85
- SSDEEP 1536:aL0SOWZsPqJWvnKt6RfoISDI1ycA89tfIYke:ULYyJWvnKt6NoISDIYM
- TLSH T1A2636B4AA6984062DA2382B4C8E34F43FA74F652271197DF6779C18D2F233C3537A756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013602\_lzma.pyd
- Size 157KB
- SHA256 2376cd374ce8c2c5ecf573226e563a96975599533f86a5f5eba5bdb705e341bb
- MD5 d412fca808a8dd9178ccf8bd9517859b
- SHA1 6088ee0ee94f6a245bac0a0d1c0e664ca630cc07
- SHA512 35afe64a19ff6737b662b9359e591bbb00c169e83609dff1c2ab1fac829316200b8a121d1bedb28bef832e7968a95e01986d20f8cb0d511e7b0d794010484e8d
- SSDEEP 3072:M0m6DHDbBwiZfxA/VcNBznfx9mNoX3mfnbOQISI1jmT:MTCHDjfDNJpYOGfbO3+
- TLSH T1E8F35C86B394F0E6F7228C38D6614F57E7F5791A0320929A01CC976D2B1FB659A2F313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013602\_queue.pyd
- Size 35KB
- SHA256 8e75c8667f938c3e9b2e9739c09b08517b487437757f125ac400c70c7eadf270
- MD5 da5725ad6e85ce51c26e6b166a42e4a0
- SHA1 11c7a9e2ad7c88eda5546ebde644d0d4dd748132
- SHA512 bd1a145368309230c4898d6d0815b17fcbb0b7ddeed8e6b76ebb8e9d9faf76bdcfd7d2f5fa39ea12ecb82ae474d5277447bc472ecf0baff911951f86cb5d28a3
- SSDEEP 768:C6KN6rbeVOX8ISRURnxycTOJh2Ip4iz2Txf1mlRaXUCWP:RbeVOX8ISRURxycA89iyfIYUz
- TLSH T157F27D89AA585197EA63C970C1A6EFC2F934F7D3470187DF2179C18A1F233C1A73A259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013602\_socket.pyd
- Size 85KB
- SHA256 42b84410269af5a5578679a3fe7b17d75d28f77a0c3c09d589adadd9d2d3e5f6
- MD5 b8732b29606a0d93be25bcd924b50239
- SHA1 e7270350e71ce191d5fac5e4a6e5e7be0d0bd1d3
- SHA512 489a3c09eb6665b6ee9b460303ac35f1228684723fabe34bb29c5de7b2b12d3fa8853e1eec8b8ba3eb3e80c517cdf1a263e6b963d4e0d2d092c52567a2ccca4d
- SSDEEP 1536:QcVunc70XTxn1egypx97XP+N6wSz9GN7WQRcSqIP4fY8ISGwyycA89gfIbHqv:FEna2Dypx97XPs6wSz9+WQyS6fY8ISG7
- TLSH T109834A00AA6040F6EB76C176C6639E63FB74F5C112D4A75F1466C65A1F33382BE3AB84
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013602\_uuid.pyd
- Size 27KB
- SHA256 d75d04aa989f8be9666505ac11339416719e38fc0701047388b061b4e576030a
- MD5 b166cfb4f4a913ed861dbe9fb93ab388
- SHA1 5e21441f6a75347c887cfac5613aa4dc102ce385
- SHA512 b290c7b4dff5daba842979439c53f495740ced0555e59ffeeafcfe9063d202cf8f5ae658adb146b94f6113e4b7305f3200d2cf357fa1ba65696b08f1ff38d4ff
- SSDEEP 768:eYV25cQISIw0xycTOJh2Ip4kzTxf1mlRaXaCK:eYV25cQISIwMycA89kRfIYab
- TLSH T1D6D26D8A9A744053FE639770D1F6DF82F939F7D34A1146AB316991860E133C1B32B2AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013602\_wmi.pyd
- Size 39KB
- SHA256 a299a6caf7241cebb0081c3ed9e98f815c61feee3e4813c1fd32369bd3fe6f5e
- MD5 72a4dfa925a2b6326a005601dcc4cb34
- SHA1 645d36a951c9f7c9ef7cf797ed600b25c04a82b1
- SHA512 46b7adc94db1ccd8773e3247a0d661784202c7ce05edbcf3a616376e011543a243c21eac776f1a07179a1f491efc23ced854fa68e7d700863463cfd2e947777a
- SSDEEP 768:q2/EEqrVmjstuQsQ9VVQIS3izxycTOJh2Ip4YTxf1ml9dHRjLJ:vE9BEbQsQ9VVQIS3iFycA89kfIbHRv
- TLSH T1E1038D89E6640092FA6BCA74C1A5CE93F575F7935712838F326582590F333D1E73A329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013602\_zstd.pyd
- Size 491KB
- SHA256 8f04a54778d4f21202f1bb9cfd5d080c5c5022158016dcaaf5908f7e2350270c
- MD5 225e0462bf8337155e78b36e3cf9fa79
- SHA1 ae944f73defa8ac5ddb3069fbb4a9da5ecafef2c
- SHA512 815201438564f8c9d57b0b8974d4b82d10bcd313e41277d85f290c0a3a94b9be8d31b5436da8704cb342f19fe68d258ee026642eca969bbb6518acd79ddb05b5
- SSDEEP 12288:MPm5BlLPg/FcxTbwWo2iD4xjnsTrWl93W6Ct0:MPm5BNg/FcxTUWo2i0x7C0
- TLSH T1FAB49D43F29943EDE17BC4B8CF465A53FBB1780B1214564B93A5CB993F07B309A6A309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013602\base_library.zip
- Size 1.2MB
- SHA256 daeb774dda676597882b94e0308a0a6c294399282d9b8fad6c7816b76645b977
- MD5 fbd06b1c5cbe73cebf9389cbaaf36efd
- SHA1 4488a6c082d577f44272e2af73954e96a833a9e8
- SHA512 ce127799c4f157b9983e5db723785e148cf71275167eff7f6e2dda2916e52d93b8af57a7d93b7e6004466769fc6ab0198dac1d38ef6d081b6ff73ed6ed48c547
- SSDEEP 12288:kKJIBzk+9/zqy0e17tPnXmIV4iSvFzQNTjnwh0bprK0LcMtV/9tSvpL:tu9/zX0eFtPnXmIV4ZFphutntSRL
- TLSH T1E24506E1B9917813FDD8F37E32B75A09A725C0419B24D303B5A48DAE6EDF250AE119CC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013602\libcrypto-3.dll
- Size 5.0MB
- SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
- MD5 8e8f32ae40518478e44269cf22cf4399
- SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
- SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
- SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
- TLSH T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013602\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013602\python314.dll
- Size 6.4MB
- SHA256 7ffe3ab11342db03cc18b026f27485c0f74f5bf10f239f1f6573394900596394
- MD5 23b7bec4bb8cf109503029b50f5eadd5
- SHA1 a5cb46bedfe2be49ae75bf0a95ab646c3256aee7
- SHA512 d687ea3c15b7fdd08ecc29e73e5310195483bae18c7b49895b0b855b0df13b0b6955d75022f842725b17e3b2ef9e922d4eb90e8819f2c8be84890d7ee49a92a3
- SSDEEP 98304:ctcc7EmUp55MA3l5vHi+LPL4G8hvGHDMiESkYD:cWc7EmUp55MMPHi9NikYD
- TLSH T1DC669E26737501A4D8BB8035C9074687DBB1BC04AB30D34B49A4B6DA3F773635BAEB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000013602\ucrtbase.dll
- Size 1.3MB
- SHA256 3239227d27667ba20d10a880751924e5719de0078f9fce232d149d383f7681f6
- MD5 b938a441aa9ab59182d0116961318531
- SHA1 58f60f8da6cf66ab224f82d41105fdda433897a9
- SHA512 8b3063e50b94d555bf73b2f6eda0bb38e71056d83de05eb0b4473b448fc0b3cb26617ff340a0c3ac69acb9ee2aacc9e5b503279c593b1b0b916204a6a7426b0c
- SSDEEP 24576:X9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8JszifmxvSZX0ypapJDBW:X9KpUmTfFqSgdDPq3DjqI08vkpJD8
- TLSH T14E55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
- MD5 SHA1 SHA512 SSDEEP TLSH