fasong | 24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 22:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
Size 1.1MB
Sample260916-19pr5afa25
SHA256 24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd
MD5 562951c2439f2370ee5241639fd53af7
SHA1 9b946978f0bb5ccabb927c146c049fd248658e87
SHA512 13d084b3faea449344807b49252c44b1db3a5c79199ebeb108ed27d78d043357f780fa89f2e6e5e8c502d3647ccf761b9603d7cd22b8db9ac6802302546efea0
SSDEEP 12288:E8kxNhOZElO5kkWjhD4AIiGtAtScw3qEKBvGtAtScw3qEKBZGtAtScw3qEKB:7qEkfFe145K145c145
TLSH
T19E45E02AB790C833D2631A78CD579768A926BE803E3955423BF82E4D5F3D3507C263D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery fasong persistence upx worm

Malware Config

Signatures

Family: Fasong
Fasong is a Windows worm written in Delphi.
worm fasong

Detects Fasong 20 IoCs

resource	yara_rule
behavioral1/memory/1884-0-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/1884-2-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/files/0x0007000000024431-11.dat	family_fasong
behavioral1/files/0x000300000001dbe8-23.dat	family_fasong
behavioral1/memory/1912-24-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/1884-25-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/1912-26-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/files/0x000700000002442f-27.dat	family_fasong
behavioral1/memory/1744-31-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/1744-33-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/2248-38-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/3696-39-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/3696-37-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/1312-34-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/1312-32-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/3696-40-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/2248-41-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/1312-42-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/2248-43-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong
behavioral1/memory/1744-44-0x0000000000400000-0x0000000000470000-memory.dmp	family_fasong

Executes dropped EXE 5 IoCs

pid	Process
1912	ZWS.EXE
1744	GIWMGZ.EXE
1312	RLX.EXE
3696	ZWS.EXE
2248	ZWS.EXE

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	ZWS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\PerfLogs\\BGQ.EXE \"%1\" %*"	ZWS.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RLX.EXE = "C:\\PerfLogs\\RLX.EXE"	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe

Enumerates connected drives 3 TTPs 34 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
File opened (read-only)	\??\K:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
File opened (read-only)	\??\N:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
File opened (read-only)	\??\P:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
File opened (read-only)	\??\G:	ZWS.EXE
File opened (read-only)	\??\H:	ZWS.EXE
File opened (read-only)	\??\L:	ZWS.EXE
File opened (read-only)	\??\R:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
File opened (read-only)	\??\V:	ZWS.EXE
File opened (read-only)	\??\H:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
File opened (read-only)	\??\J:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
File opened (read-only)	\??\L:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
File opened (read-only)	\??\S:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
File opened (read-only)	\??\T:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
File opened (read-only)	\??\V:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
File opened (read-only)	\??\N:	ZWS.EXE
File opened (read-only)	\??\Q:	ZWS.EXE
File opened (read-only)	\??\O:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
File opened (read-only)	\??\I:	ZWS.EXE
File opened (read-only)	\??\M:	ZWS.EXE
File opened (read-only)	\??\R:	ZWS.EXE
File opened (read-only)	\??\T:	ZWS.EXE
File opened (read-only)	\??\U:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
File opened (read-only)	\??\E:	ZWS.EXE
File opened (read-only)	\??\U:	ZWS.EXE
File opened (read-only)	\??\S:	ZWS.EXE
File opened (read-only)	\??\P:	ZWS.EXE
File opened (read-only)	\??\I:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
File opened (read-only)	\??\M:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
File opened (read-only)	\??\Q:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
File opened (read-only)	\??\J:	ZWS.EXE
File opened (read-only)	\??\K:	ZWS.EXE
File opened (read-only)	\??\O:	ZWS.EXE
File opened (read-only)	\??\E:	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1884-0-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/1884-2-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/files/0x0007000000024431-11.dat	upx
behavioral1/files/0x000300000001dbe8-23.dat	upx
behavioral1/memory/1912-24-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/1884-25-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/1912-26-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/files/0x000700000002442f-27.dat	upx
behavioral1/memory/1744-31-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/1744-33-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2248-38-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/3696-39-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/3696-37-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/1312-34-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/1312-32-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/3696-40-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2248-41-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/1312-42-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/2248-43-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral1/memory/1744-44-0x0000000000400000-0x0000000000470000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GIWMGZ.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RLX.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZWS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZWS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZWS.EXE

Modifies registry class 17 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\GIWMGZ.EXE %1"	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\PerfLogs\\RLX.EXE \"%1\" %*"	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	ZWS.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\PerfLogs\\BGQ.EXE \"%1\" %*"	ZWS.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command\ = "C:\\PerfLogs\\RLX.EXE \"%1\""	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "C:\\PerfLogs\\RLX.EXE %1"	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell\open\command	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQfile\shell	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QQQ.file\shell\open\command\ = "C:\\Users\\GIWMGZ.EXE %1"	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1912	ZWS.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1912	1884	24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe	85
PID 1312 wrote to memory of 3696	1312	RLX.EXE	93
PID 1744 wrote to memory of 2248	1744	GIWMGZ.EXE	94

C:\Users\Admin\AppData\Local\Temp\24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe
"C:\Users\Admin\AppData\Local\Temp\24894f25c51d570037b76a130d2a83d292b44929d9bd67febd2460b3a89d7dbd.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1884
- C:\PerfLogs\ZWS.EXE
  C:\PerfLogs\ZWS.EXE
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1912

C:\Users\GIWMGZ.EXE
C:\Users\GIWMGZ.EXE
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744
- C:\PerfLogs\ZWS.EXE
  C:\PerfLogs\ZWS.EXE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2248

C:\PerfLogs\RLX.EXE
C:\PerfLogs\RLX.EXE
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312
- C:\PerfLogs\ZWS.EXE
  C:\PerfLogs\ZWS.EXE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RLX.EXE

Path C:\PerfLogs\RLX.EXE
Size 1.1MB
SHA256 df42463f48f361ec8a40c311a920aa557003c8d78fe42a0d94d668ce7deee7d9
MD5 e01aaf7834e18558643ceb979465c9e9
SHA1 a8396fb78893c0bbf6a58576e49cffad826ae75d
SHA512 7ac3871b4344d4fae84182eef15bd1d559029ebed4c8462747b7da2dd7ada5ebe50a42cc8cd029ece38841f331b71d54ba57709838ccdf865eed2bf33341fb48
SSDEEP 12288:E8kxNhOZElO5kkWjhD4AIiGtAtScw3qEKBvGtAtScw3qEKBZGtAtScw3qEKB:7qEkfFe145K145c145
TLSH
T15C45E02AB790C833D2631A78CD579768A926BE803E3955423BF82E4D5F3D3507C263D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZWS.EXE

Path C:\PerfLogs\ZWS.EXE
Size 1.1MB
SHA256 176abc6d66e4a35366bf0dad6c89e869bd3b0c185e5b3fe96b73ac99ee9adc73
MD5 e5e632327879b57ceeb431fe96908a42
SHA1 88d87d5adc25bb76c36e226812022d8198f2aa0a
SHA512 968c4d3869adbc77605bc3084e8282fad9b537bbb39ab83db6a6aa7e43aa67f2a2f745f262eb6a160a9c9172344d9288f68d18d5db2f1fba088e816349ddb0b3
SSDEEP 12288:E8kxNhOZElO5kkWjhD4AIiGtAtScw3qEKBvGtAtScw3qEKBZGtAtScw3qEKB:7qEkfFe145K145c145
TLSH
T18345E02AB790C833D2631A78CD579768A926BE803E3955423BF82E4D5F3D3507C263D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GIWMGZ.EXE

Path C:\Users\GIWMGZ.EXE
Size 1.1MB
SHA256 5280b2568244643b6549bcadcee1a99758a24717ef7d9387fa3984b46eacf47a
MD5 1c4b321bb445c71260f3cb42e5a947c4
SHA1 1ada85ed533acdd4900620aabbfb1c0e7f50c96e
SHA512 5faf4b64e6b2725098dc04dc2852bb49661bde97986573e3eaca7e04b4df5bb35ef54ab6b6e5fd4d9e78c729319ac612aa805ce08853cc92948090d3e8994ce8
SSDEEP 12288:E8kxNhOZElO5kkWjhD4AIiGtAtScw3qEKBvGtAtScw3qEKBZGtAtScw3qEKB:7qEkfFe145K145c145
TLSH
T10845E02AB790C833D2631A78CD579768A926BE803E3955423BF82E4D5F3D3507C263D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filedebug

Path \??\c:\filedebug
Size 210B
SHA256 1efaa6436b422304240f17309f7b680cfd527909e928d39e4ded2dbf7a618508
MD5 650491e3cbd9f7693c2286b596a8055d
SHA1 3cd4499b6c5bc865e26bd49001dbd81608a61e41
SHA512 92e77862049cd21ecb1c7fbcefafd7ef4314d59735e87ddb9d8aef9d612dee88a0110435a9df833b1207b757f7939ab90fea47c6539844d0e86a9f3cce22e6d0
TLSH
T136D002DF88E0C265EF942F12A7250E9AB0CC9DCBC40D198CC27656CB0C60CCA01A1CB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1312-42-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1312-32-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1312-34-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1744-33-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1744-31-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1744-44-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1884-2-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1884-0-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1884-1-0x000000000045A000-0x000000000045B000-memory.dmp

Download

memory/1884-25-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1912-26-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1912-24-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2248-38-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2248-41-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2248-43-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/3696-40-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/3696-37-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/3696-39-0x0000000000400000-0x0000000000470000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads