ca27f5ffe24dd12b91ab17060dfd7cb08427850d6292853526de5237b408f1ea

Analysis

max time kernel
150s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mumu-magisk-1click-main/MuMuInstaller.exe
Size 5.5MB
Sample260910-sgcyvsde34
SHA256 ca27f5ffe24dd12b91ab17060dfd7cb08427850d6292853526de5237b408f1ea
MD5 d820f350968269e711f8ccc747ad398f
SHA1 0b6c3fcfae30e71bdc13a88d6c182d3e338b031a
SHA512 430c2db53ff13b9ef94006516cb4e9fa56a7d4e6ed05cd0503cfafa24341448ce92342db25b2611bfb3d26fda382ca7dc7fc384b525828bd2cd0cd36e1d2b670
SSDEEP 98304:Me221urJKtGn7xlt3HbAndGaX6tJJQv2FKA75OpVclc02vDRZTEq:Z221u8mlHbKo3u0jc02vVZoq
TLSH
T10A4622272E2EF10FD0115AB6E1D73AE8075BBE25D1B34C614457268B2762CFB9A3D01B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	nemu-downloader.exe

Executes dropped EXE 6 IoCs

pid	Process
5664	nemu-downloader.exe
3296	ColaBoxChecker.exe
3620	HyperVChecker.exe
5640	WinRing0x64.sys
1944	HyperVChecker.exe
2620	HyperVChecker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MuMuInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nemu-downloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColaBoxChecker.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5664	nemu-downloader.exe
5664	nemu-downloader.exe
5664	nemu-downloader.exe
5664	nemu-downloader.exe
5664	nemu-downloader.exe
5664	nemu-downloader.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 5664	2256	MuMuInstaller.exe	89
PID 5664 wrote to memory of 3296	5664	nemu-downloader.exe	90
PID 5664 wrote to memory of 3620	5664	nemu-downloader.exe	93
PID 5664 wrote to memory of 1944	5664	nemu-downloader.exe	97
PID 5664 wrote to memory of 2620	5664	nemu-downloader.exe	99

C:\Users\Admin\AppData\Local\Temp\mumu-magisk-1click-main\MuMuInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\mumu-magisk-1click-main\MuMuInstaller.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\7z91A288D0\nemu-downloader.exe
  C:\Users\Admin\AppData\Local\Temp\7z91A288D0\nemu-downloader.exe
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Users\Admin\AppData\Local\Temp\7z91A288D0\ColaBoxChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z91A288D0\ColaBoxChecker.exe" checker /baseboard
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3296
- - C:\Users\Admin\AppData\Local\Temp\7z91A288D0\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z91A288D0\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\7z91A288D0\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z91A288D0\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\7z91A288D0\HyperVChecker.exe
    "C:\Users\Admin\AppData\Local\Temp\7z91A288D0\HyperVChecker.exe"
    3⤵
    - Executes dropped EXE
    PID:2620

C:\Users\Admin\AppData\Local\Temp\7z91A288D0\WinRing0x64.sys
C:\Users\Admin\AppData\Local\Temp\7z91A288D0\WinRing0x64.sys
1⤵
- Executes dropped EXE
PID:5640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ColaBoxChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\7z91A288D0\ColaBoxChecker.exe
Size 4.0MB
SHA256 1373c5d006a5dbcd9b86cfff9a37616f1245d1333c4adcefc7cd18926b98d752
MD5 839708e3f96cf055436fa08d6205263c
SHA1 a4579f8cb6b80fe3fd50099794f63eb51be3292f
SHA512 ece67e031e06a0442d935e7d81d0eed57ae92b348b5d104423577478ce226e4a4bde834c54e31d33bfe6f574fb7798ba96886d9e8edb738edee6e7c9c43054cd
SSDEEP 49152:VgP8dFBouKaau2VgFLTeJxx8IHqQOPclSWkar66Dv4TpN1KjH304dAHRvOL:2P8dFuudB0gFLQ2QOQ660TpN1eX3d9
TLSH
T18F167D31370BC135FF8281B7456DABAB437C8A650B7340DB92D42BBAD9352E22B35D52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HyperVChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\7z91A288D0\HyperVChecker.exe
Size 117KB
SHA256 9ff467bc5a1c377102d25da9fa9c24dcc4375f456510f71584f0714fdfb2af39
MD5 dbd84c6083e4badf4741d95ba3c9b5f8
SHA1 4a555adf8e0459bfd1145d9bd8d91b3fff94aad0
SHA512 fb5fe74f64254609e07d6642acf904562bb905cd7c14c6f85ba31bcdbaf06686c0586609ec4f5d2f8f55ff90334dcbb774a3a6e78df74bf1b1d0cd03dec21870
SSDEEP 3072:BwLn2WoLPivTkgxUJ8UrtmMx7bB5dSUo+Wy9sxtb:gn2WoLP++J8Upo+Wy9Q
TLSH
T189C37D57B3A434F5F17B8638C4950A49DB72B8320B609FAF03A842961F637D25D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRing0x64.sys

Path C:\Users\Admin\AppData\Local\Temp\7z91A288D0\WinRing0x64.sys
Size 32KB
SHA256 d5bca2ca464a6cc91344bd85e812a7bac6e7c67038c4929a29e0bc60c7eabe4d
MD5 1c57d067b9fc5e9ef9aeb14223481243
SHA1 4ee59164d3259667d3cade58f4c93b4dddf5a92b
SHA512 a8de7ab7f67cbe2bf25fd772c24344031322dfab77d07fd835109530450683c158f37955982e875a3acbbfaea2e72c0ba5a52d85f3e1e58984ec63c96f6c0ccd
SSDEEP 384:lPb2XaqB7HPBIkFEOUrz6+nYPL6RKtUEMUo7HI5JNNzFwhhiCI9Zh3VDldl99kmm:lPKP7PGLNzFpHjS3wh/IZ3
TLSH
T16CE24AD70A2D6443EFCBEC7092D9E657AC38B3D26B9544DB10BADA941DC3BC52B2801D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baseboard

Path C:\Users\Admin\AppData\Local\Temp\7z91A288D0\baseboard
Size 115B
SHA256 8c2b842cf14ae55306c66dc92f96293b8f5a1415d0836891d54b4c1bbc40ea7d
MD5 16fc8ad548ef186fc055af15aed5a121
SHA1 0f7218e96150f2d06bdce671609f4f4eff4f1a3f
SHA512 652f894008272836fd48a5991bd36afeb46e12cbe421370e1229afa40c86458952c4b2e02dae7fd35b2335e98084bbca1ab006796f29d58c37922c4097e55d8d
TLSH
T153B09228E2932C43C14A44440036C5922A514CB38A00ACB02745056C0B48A6B2E9798D
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\7z91A288D0\config.ini
Size 336B
SHA256 2e408a64d1c05facf7904aecc63d14d918f36f795ee6ae5d66ef3968cb7e7ac6
MD5 45846cca2fcac030477eb724cc85df87
SHA1 9c2b4cc4722cfe53512ee54546990f6fa2d91d2f
SHA512 57a18ab527dbc28919e017fe47a56ae82681ad8b6c8e0eca498867e23c559d56e662bc402d1e1ed682145822f8bbbcc337d5610e528dba1e54679c3c23f18db9
TLSH
T161E0127926228512B6027FC924173311AC7EB1F33E404494EB1DE676B933C26D22741B
MD5 SHA1 SHA512 TLSH

Submit Download

nemu-downloader.exe

Path C:\Users\Admin\AppData\Local\Temp\7z91A288D0\nemu-downloader.exe
Size 3.2MB
SHA256 5211b47f7234202629806e30376382ef7e5a9263edf89060244758f0b0335532
MD5 0468b98df0bc31b51791134167d590ec
SHA1 6660bde4a205a90d4c55f78c0c40efcfc9e3f7b0
SHA512 8838bde8211ce71a964a2d8c6b4990a156d0827c0065137db0a491a8da4d9215b80fe6b315fc5ae5f35d66d57e593358a815327d6503efe96a90c9e47890f7bb
SSDEEP 49152:bls+XZTecse07VOhHyioa2y4NKU6QZ+da068Hao2aRqnTSWQosdNXuo8X:7Z6u0qQa2vNVZ+da06SL24jNXQ
TLSH
T186F56C11BA52E13AF8F304B789BE165D412DBE21071588C793C4196F0BB6DE27B36B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\7z91A288D0\skin.zip
Size 1.5MB
SHA256 9633749969c8d1d5f84bf0f30eddc63e64e524298ec1fd487fa53b8b739dde01
MD5 f0fa80ea5e92539149d34214be3f4e6c
SHA1 5ace90bf207cc5f8451819c35861e86f7b7cc8bc
SHA512 9046bef23acb7a2caa591b0837965f5364f7a9fc83043d7a487b285e6ee55738e505d5c0d449708f9c634ef22ab3e7f29e26558c3da20bca4cde85bc966b9faa
SSDEEP 24576:b/44gaY1oa/VEnJ+jixFYTyA2oiIas1iM/jmF3NaFimO2WSVwqIwsfaA/vmfDVQ8:JgZ2OW2YYQIT48CFS9PWgI1yw+fMrZ8B
TLSH
T10F6523B65B42916BCE358B78B7210D88B71FF353E8B2D90E4120B52F8FC995D1388667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download