Analysis

  • geolocation tags

    eueuropelondonukunited-kingdom
  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-uk
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-uklocale:uk-uaos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 11:00

General

  • Target
    FPinger_5_0_1.exe
  • Size 4.0MB
  • Sample260910-m4bfnabk91
  • SHA256 6356a5f8ad772c7e5b338a139964b9433f4617c0c938ecdeffbde2c2a7267951
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FPinger_5_0_1.exe
    "C:\Users\Admin\AppData\Local\Temp\FPinger_5_0_1.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    • Suspicious use of WriteProcessMemory
    PID:2696
    • C:\Program Files (x86)\FPinger\FPinger.exe
      "C:\Program Files (x86)\FPinger\FPinger.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1056

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        FPinger.exe

        • Path C:\Program Files (x86)\FPinger\FPinger.exe
        • Size 2.7MB
        • SHA256 ac8290501b36664c806941f13f3a864cf6f195898d50a9f83d2af1df3232f6b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Bridge.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Bridge.gif
        • Size 426B
        • SHA256 a27dd1ceb2d0e46fcf8d7dc75d9fb1d218166e49f50f1989b5f9f0023e24f408
        • MD5 SHA1 SHA512 TLSH

        Card.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Card.gif
        • Size 318B
        • SHA256 1bf6b989f1c0db9bff3035a4d93a41cf293860534e9a358fd416e3dc579bfa07
        • MD5 SHA1 SHA512 TLSH

        City.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\City.gif
        • Size 646B
        • SHA256 ff50cb15975a7c79aac3cf9e0b69187bcc461a21c96b87a1c61fa47a0c8184a8
        • MD5 SHA1 SHA512 TLSH

        Computer.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Computer.gif
        • Size 328B
        • SHA256 7fa3e2a21fd448631e5ccaf216b5767788ce57e0125b0ed835413762317c2359
        • MD5 SHA1 SHA512 TLSH

        Fax.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Fax.gif
        • Size 1KB
        • SHA256 6af0d8ef67474cf90b51eeba6652c0a3b8262a469f89681d96c34fb469c701a8
        • MD5 SHA1 SHA512 TLSH

        Firewall.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Firewall.gif
        • Size 425B
        • SHA256 283148905aa1f9c96ce271793150635c417410dc62ca4925f2291c61c1a20918
        • MD5 SHA1 SHA512 TLSH

        Folder.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Folder.gif
        • Size 247B
        • SHA256 949570819b8b4aecfeed20ce9c3de3147fa91877e768b08858974412d0d158dd
        • MD5 SHA1 SHA512 TLSH

        Hub.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Hub.gif
        • Size 441B
        • SHA256 64e47ab8c764b295176ad1b1d722ddcff6ef6c3adcde9c96749eee60eec34aae
        • MD5 SHA1 SHA512 TLSH

        InternetServer.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\InternetServer.gif
        • Size 1KB
        • SHA256 cedd1342c99b3609bd4dca732a21bba23a2bf548d499c222bebf199f27c87d37
        • MD5 SHA1 SHA512 TLSH

        InternetShortcut.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\InternetShortcut.gif
        • Size 244B
        • SHA256 e12373bf7af1686f907e8d2431ba10064b38fe421f8ce8f9f44acc3bc83e75cf
        • MD5 SHA1 SHA512 TLSH

        Laptop.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Laptop.gif
        • Size 640B
        • SHA256 069c9297815d035b85a7c5ace20cb11839cd0d28ad43a5465557210e946d3d0f
        • MD5 SHA1 SHA512 TLSH

        MailServer.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\MailServer.gif
        • Size 716B
        • SHA256 1e3e214fe583677b5f797873a64fc70799113dfc0312714bd6b73a3b77fb4b96
        • MD5 SHA1 SHA512 TLSH

        MainFrame.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\MainFrame.gif
        • Size 946B
        • SHA256 aca80387a1bdaf5ee385c9ca7a1574785890359b5d8275873e80379ba55b0e4a
        • MD5 SHA1 SHA512 TLSH

        MiniComputer.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\MiniComputer.gif
        • Size 600B
        • SHA256 23273f62e185bfc490df198e20c0e2100a1f5fbc0b909fc1337ca1ad2fd0375e
        • MD5 SHA1 SHA512 TLSH

        Modem.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Modem.gif
        • Size 248B
        • SHA256 1cb54f21d747362c37a57ebdfb252a955648632c030af437c6cca868a6d95634
        • MD5 SHA1 SHA512 TLSH

        Multiplexer.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Multiplexer.gif
        • Size 571B
        • SHA256 142a601e9ec3884e463e5dd9f3174a18fe5bc0258efcba899910d18065b6b26b
        • MD5 SHA1 SHA512 TLSH

        Network.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Network.gif
        • Size 997B
        • SHA256 fb4ee78610867d818b63b71c91c7893cdbb79b80cdb63ea7eb03d2aac13c0eac
        • MD5 SHA1 SHA512 TLSH

        PDA.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\PDA.gif
        • Size 344B
        • SHA256 c7c3330f0e08de6ffef18bc5d344ab2760be06fedb4d1045c7d1822bdd0dbf6c
        • MD5 SHA1 SHA512 TLSH

        Plotter.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Plotter.gif
        • Size 586B
        • SHA256 f489b2d38796c83b47eca34087da69725c8730d47c141a94030fdc8ae6482e85
        • MD5 SHA1 SHA512 TLSH

        Printer.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Printer.gif
        • Size 677B
        • SHA256 7f9312e3e116188635f49049e2a8f43d9131968cdf497e122b423ae2035568d4
        • MD5 SHA1 SHA512 TLSH

        Repeater.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Repeater.gif
        • Size 265B
        • SHA256 4a81a5b59fd69ebcf8e988f63fdc7a6af5169e0325b6573fae74742902e3ca1e
        • MD5 SHA1 SHA512 TLSH

        Router.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Router.gif
        • Size 631B
        • SHA256 58ead19cd7d3a7a334b37c6a01fa0b43d65f8b51a6d0d3db7ded574b2afe5fab
        • MD5 SHA1 SHA512 TLSH

        Scanner.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Scanner.gif
        • Size 464B
        • SHA256 428cc7b397acd3e030efc1e39e4559771537728bff6ffb0937a98348e624e013
        • MD5 SHA1 SHA512 TLSH

        Server.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Server.gif
        • Size 523B
        • SHA256 9c76f277d7218586be1fb9d58ff69e8729cfb3e1d0fecc665e054582328da17d
        • MD5 SHA1 SHA512 TLSH

        SharedResource.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\SharedResource.gif
        • Size 316B
        • SHA256 ea2f7934ab8ab87e2409a697100294f1dc0ad941d85070bb8701df804103421e
        • MD5 SHA1 SHA512 TLSH

        Telephone.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Telephone.gif
        • Size 388B
        • SHA256 b0d7b74b4b430eb2303fb208f743be9582cec28d17c53eb6ed5499d584c21d09
        • MD5 SHA1 SHA512 TLSH

        TerminalServer.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\TerminalServer.gif
        • Size 455B
        • SHA256 e01ba5fdc279dd9cd7f54b78cd2f2277202bf32e521421a596eca47291674583
        • MD5 SHA1 SHA512 TLSH

        Town.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\Town.gif
        • Size 1017B
        • SHA256 a921585bbe88136a5dedd9a7c5e7de063346607042cedea3381ea23eb516c8f8
        • MD5 SHA1 SHA512 TLSH

        WorkStation.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\WorkStation.gif
        • Size 430B
        • SHA256 2cd97692c7c3620ab2929f4ce917be22db1dc64ef82787e2e941689e8bf486d4
        • MD5 SHA1 SHA512 TLSH

        WorkStationSmall.gif

        • Path C:\Program Files (x86)\FPinger\Images\Off\WorkStationSmall.gif
        • Size 166B
        • SHA256 25c25414b401ae006748afdabfe2a493087929f228f42e963d03b4b6e9b7891b
        • MD5 SHA1 SHA512 TLSH

        Bridge.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\Bridge.gif
        • Size 443B
        • SHA256 39ee133a5a6142c78319a4f82b85c1edf3683cc4c1ecb25e95218095820040ed
        • MD5 SHA1 SHA512 TLSH

        Card.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\Card.gif
        • Size 753B
        • SHA256 bbaca2a28ce3f94392d28fffa4973aa9c5c7fd6974ac0a5e4fd4c1f06ec87bba
        • MD5 SHA1 SHA512 TLSH

        City.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\City.gif
        • Size 751B
        • SHA256 b61209b492bf9f331520ef7020d78127e73464cfc6bb3cba3f7aafd31eb7f608
        • MD5 SHA1 SHA512 TLSH

        CommTower.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\CommTower.gif
        • Size 1KB
        • SHA256 fd22affd8065ff99864b7b904924cb143d8c5e9c47eefa2c935ffbbb3e69a93f
        • MD5 SHA1 SHA512 TLSH

        Computer.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\Computer.gif
        • Size 1KB
        • SHA256 d2e9a32f2fc6eb1eb38dbe4dc2d88e1e12fa2aff21309604ebe388ff43aaacf7
        • MD5 SHA1 SHA512 TLSH

        Folder.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\Folder.gif
        • Size 278B
        • SHA256 5ed3acc194c129aee02ee94481ca35358c1750d6976f0f0faa6f42a4d2be2b17
        • MD5 SHA1 SHA512 TLSH

        Laptop.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\Laptop.gif
        • Size 662B
        • SHA256 3b511e79557c7dc3b11dcd6a7ecce8818983bd44cecddff7312fc3997ce4c432
        • MD5 SHA1 SHA512 TLSH

        MainFrame.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\MainFrame.gif
        • Size 1KB
        • SHA256 0d669c85fa03f7198a5a25242bd55362848efd20bbe917c4d89f2084a7144859
        • MD5 SHA1 SHA512 TLSH

        MiniComputer.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\MiniComputer.gif
        • Size 710B
        • SHA256 73c8c783df21845602f6bd2376faef68131f3ccc52c78925c52a7364c20a7bf3
        • MD5 SHA1 SHA512 TLSH

        Multiplexer.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\Multiplexer.gif
        • Size 594B
        • SHA256 28adc5c3f3d4ec9838ffa4bd751c5886a8727210919ffee2fea9bae75c15fbb5
        • MD5 SHA1 SHA512 TLSH

        Network.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\Network.gif
        • Size 1KB
        • SHA256 1060f02bd87493d26b5ab196e165983cd5c62ef20aca528dd7b5212df71285bb
        • MD5 SHA1 SHA512 TLSH

        PDA.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\PDA.gif
        • Size 480B
        • SHA256 162309a400b8b9d2fb144ec0d9fbad7e80aa42c127f236e7eda29de9ea725946
        • MD5 SHA1 SHA512 TLSH

        Router.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\Router.gif
        • Size 672B
        • SHA256 fc0e065b05d91b38d8ba6d8cc84e4354d1e9d780d1a4ed1237d0d4a79031a3c0
        • MD5 SHA1 SHA512 TLSH

        Satellite.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\Satellite.gif
        • Size 859B
        • SHA256 d27e7379b73d889e82a06fd97f034050bb215915adc4dbfd27acc9dbfc64bf38
        • MD5 SHA1 SHA512 TLSH

        SatelliteDish.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\SatelliteDish.gif
        • Size 664B
        • SHA256 c666a8ab5bbbe4a240f7758e2f2eff19e61c5ada3e974236ca3f19e49785611a
        • MD5 SHA1 SHA512 TLSH

        Server.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\Server.gif
        • Size 519B
        • SHA256 1b2efac0388a42fd574ab89667ef2a61778348249ce5c3eac619393e6d0a15de
        • MD5 SHA1 SHA512 TLSH

        SharedResource.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\SharedResource.gif
        • Size 365B
        • SHA256 053bd724ce365fe3790a2ca1b61b903bce199c1a46b57c4a0e097ecb263210ff
        • MD5 SHA1 SHA512 TLSH

        Switch.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\Switch.gif
        • Size 1KB
        • SHA256 5435e1559945b4271f4bc0ee450b03115c0146b27e2d6690ad0affddf300a75d
        • MD5 SHA1 SHA512 TLSH

        TerminalServer.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\TerminalServer.gif
        • Size 489B
        • SHA256 a3336b1f25ed7493c6d97540cb9e22733bc2a254c443a8ef8cb9a4e0b7f5e081
        • MD5 SHA1 SHA512 TLSH

        Town.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\Town.gif
        • Size 1KB
        • SHA256 46937ac38a01ad267d13682a76077224827b1d9f83f82d30a21ad40367336416
        • MD5 SHA1 SHA512 TLSH

        WorkStation.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\WorkStation.gif
        • Size 528B
        • SHA256 2f959e1f8c144967f9da2cae40b4312c699679cb0237c80c8e4925c0fd6aebef
        • MD5 SHA1 SHA512 TLSH

        WorkStationSmall.gif

        • Path C:\Program Files (x86)\FPinger\Images\On\WorkStationSmall.gif
        • Size 842B
        • SHA256 d954e1864b08aff949cf51ae7616126e2b0ce502336b14e326723eb7d66c6888
        • MD5 SHA1 SHA512 TLSH

        Demo.map

        • Path C:\Program Files (x86)\FPinger\Maps\Demo.map
        • Size 6KB
        • SHA256 7b671dfdb0f70eccb055dc5f34ef44795c50bad5c905997aa112ad4e073af491
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Connect.dll

        • Path C:\Program Files (x86)\FPinger\Plugins\Connect\Connect.dll
        • Size 40KB
        • SHA256 6154d2352fd8cb2170d0a9456724230afb58bd1a03be6195c4d659030d7f1f60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FileExist.dll

        • Path C:\Program Files (x86)\FPinger\Plugins\FileExist\FileExist.dll
        • Size 40KB
        • SHA256 fdd5462959246248760f87d8810743425f207b0c22059d2a348e035d06cb3a01
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FolderExist.dll

        • Path C:\Program Files (x86)\FPinger\Plugins\FolderExit\FolderExist.dll
        • Size 39KB
        • SHA256 71c8063645f648e453f8ed8528fa6394cf6732aac5197504cf8fdaa1b1f7e93e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/1056-167-0x0000000000400000-0x00000000006B6000-memory.dmp

        memory/1056-238-0x0000000000400000-0x00000000006B6000-memory.dmp

        memory/1056-272-0x0000000000400000-0x00000000006B6000-memory.dmp

        memory/1056-166-0x00000000005E5000-0x00000000005E6000-memory.dmp

        memory/1056-175-0x0000000004510000-0x000000000451F000-memory.dmp

        memory/1056-268-0x0000000000400000-0x00000000006B6000-memory.dmp

        memory/1056-171-0x0000000004400000-0x000000000440F000-memory.dmp

        memory/1056-237-0x0000000004620000-0x000000000462E000-memory.dmp

        memory/1056-236-0x0000000004510000-0x000000000451F000-memory.dmp

        memory/1056-235-0x0000000004400000-0x000000000440F000-memory.dmp

        memory/1056-234-0x0000000000400000-0x00000000006B6000-memory.dmp

        memory/1056-179-0x0000000004620000-0x000000000462E000-memory.dmp

        memory/1056-239-0x0000000000400000-0x00000000006B6000-memory.dmp

        memory/1056-243-0x0000000000400000-0x00000000006B6000-memory.dmp

        memory/1056-250-0x0000000004620000-0x000000000462E000-memory.dmp

        memory/1056-249-0x0000000004510000-0x000000000451F000-memory.dmp

        memory/1056-248-0x0000000004400000-0x000000000440F000-memory.dmp

        memory/1056-247-0x0000000000400000-0x00000000006B6000-memory.dmp

        memory/1056-252-0x0000000000400000-0x00000000006B6000-memory.dmp

        memory/1056-256-0x0000000000400000-0x00000000006B6000-memory.dmp

        memory/1056-260-0x0000000000400000-0x00000000006B6000-memory.dmp

        memory/1056-264-0x0000000000400000-0x00000000006B6000-memory.dmp

        memory/2696-155-0x0000000000400000-0x0000000000503000-memory.dmp

        memory/2696-181-0x0000000000400000-0x0000000000503000-memory.dmp