540fb60cc7239cf583b3b5969501e5b67169b48fb040b7cd6595de3a04b3d6fa

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fsa_downloader_b3d6fa.exe
Size 4KB
Sample261002-phd1rsts9j
SHA256 540fb60cc7239cf583b3b5969501e5b67169b48fb040b7cd6595de3a04b3d6fa
MD5 4f7bbcd074cbac4fb44905ace5cc42e3
SHA1 64cd594123fe104f5dadf38558d9b4d6ba893c05
SHA512 660c9e0f0f3e0e907edff395bf7d2fd84e583f9f7488cd3182f3c28b5fb80a0b19295121460a02cde9ad9894d645003c096160d5dcf3480187631b34b68643fc
TLSH
T155815E270984BAA1C2CD823CBC96E06F9CEF1DF28C53824729EF180E07E51235AF2549
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fsa_downloader_b3d6fa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fsa_downloader_b3d6fa.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsa_downloader_b3d6fa.exe

EICAR Anti-Malware test file 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c53d-3.dat	eicar_test_file

C:\Users\Admin\AppData\Local\Temp\fsa_downloader_b3d6fa.exe
"C:\Users\Admin\AppData\Local\Temp\fsa_downloader_b3d6fa.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eicar[1].com

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MJOBZ9FO\eicar[1].com
Size 69B
SHA256 131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267
MD5 69630e4574ec6798239b091cda43dca0
SHA1 cf8bd9dfddff007f75adf4c2be48005cea317c62
SHA512 5581f85b25f0d80fa84c69e7ca24d98344f5fbaec45b7707dccf139a8c065961391d6e762516ee1db3137c4d82eca7fbc67c348c37ea0d615bb88161cf3b3008
TLSH
T1E6A022003B0EEE2BA20B00200032E8B00808020F2CE00A3820A020B8C83308803EC228
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads