f4badf0cdbc0099ed54b5ae07a5d940cfd314ede11cf476ccf11cc13a6fa9f87

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/09/2026, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Uno.exe
Size 171.8MB
Sample260915-rczfmast4l
SHA256 f4badf0cdbc0099ed54b5ae07a5d940cfd314ede11cf476ccf11cc13a6fa9f87
MD5 7671026cacf3f272a30b6ee33aad8143
SHA1 c4c279508e18da0d5f7b96bd762a52017737ae8d
SHA512 949d7021aea58ccb904274b074289e7da8195e7784dd53410eff714a9b85c1cca622075d075d6e109db02bbea2a235abe20194b9b4740f23217bdb79c5f3a994
SSDEEP 1572864:TasGSAvwGc3AWWR6cN2rxlMxg3fkRPgGFDyrakAcihuSrK6yj0Jip5hMj6xCL4N:b4fc/M+i6xCL
TLSH
T157888C03E29A51D9E01DE1B5978B9233EE71B8454B29B2DF275407522F7BEE42B3CB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4552	javaw.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	discord.com
7	discord.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4552	javaw.exe
4552	javaw.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 4552	3796	Uno.exe	83
PID 3796 wrote to memory of 956	3796	Uno.exe	82
PID 3796 wrote to memory of 956	3796	Uno.exe	82

C:\Users\Admin\AppData\Local\Temp\Uno.exe
"C:\Users\Admin\AppData\Local\Temp\Uno.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Users\Admin\AppData\Local\Temp\Uno.exe
  "C:\Users\Admin\AppData\Local\Temp\Uno.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Uno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1700,i,8840753744432068842,5324305092443216331,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:2
  2⤵
  PID:956
- C:\Users\Admin\AppData\Local\Temp\resources\java\jre\bin\javaw.exe
  C:\Users\Admin\AppData\Local\Temp\resources\java\jre\bin\javaw.exe --enable-native-access=ALL-UNNAMED -Djava.awt.headless=false --add-opens java.base/java.lang=ALL-UNNAMED -cp C:\Users\Admin\AppData\Local\Temp\resources\java\bb3df2b1175b.jar V ira-f45bbf1d
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jna6013280225577375615.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna6013280225577375615.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4552-25-0x000001EEC8870000-0x000001EEC887E000-memory.dmp

Download