Analysis

  • user interaction
    yes
  • max time kernel
    156s
  • max time network
    178s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/10/2026, 23:37

General

  • Target
    lego-five-nights-at-freddy-s-1.exe
  • Size 504.3MB
  • Sample261004-3mckdsts4n
  • SHA256 324b66ef5e2ef4245533649ec3a7d33902217a42535d2c5ae1582feaaff7e209
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 28 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\lego-five-nights-at-freddy-s-1.exe
    "C:\Users\Admin\AppData\Local\Temp\lego-five-nights-at-freddy-s-1.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2708

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DRPC.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\DRPC.mfx
        • Size 861KB
        • SHA256 5e7c4bcc7b722179ca5de3933d0e807d0d1630d8e5a0a51b98cce85199051ea5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Get.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\Get.mfx
        • Size 340KB
        • SHA256 791e717345991c4bf183c6450667498a89b59c4e8a5abb52e2751fde63d3ad43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        INI++15.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\INI++15.mfx
        • Size 439KB
        • SHA256 4f7e3cc575de56d815589db22a1d96760e2f309e58b9bde1a57e108bda069393
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Layer.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\Layer.mfx
        • Size 136KB
        • SHA256 6f06ea2607309aecfc35589c5a0f1799dc3cf6627841e3dc56347810e6197dd8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Registry2.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\Registry2.mfx
        • Size 28KB
        • SHA256 48d5965b2347cfda307f87667f46ef1fcc698b2842bf8cb4669d96c44f2017f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Steamworks.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\Steamworks.mfx
        • Size 328KB
        • SHA256 0c01bfa11e5371d5f812f551f0af32099e95785dd44a053506f56b9dd0713329
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kcclock.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\kcclock.mfx
        • Size 106KB
        • SHA256 d79eb00cd7822b836f4a7522c0a2acd08ab9955c3ee625a90ed8e8a177eab2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kcfile.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\kcfile.mfx
        • Size 116KB
        • SHA256 7daa995fbf72b941859177b08b2785dc107f1a3deb99f6ab4c675d2b0f03a06b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kclist.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\kclist.mfx
        • Size 32KB
        • SHA256 c83bcec56f1666d6871e077cc54d0ee7f6462773c03afbb301b9180a4ad0a31a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kcplugin.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\kcplugin.mfx
        • Size 24KB
        • SHA256 10491218743ff2421d8d5cbbe622afc23b2256f27cebbd5ad6f035d914b9a2bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kcpop.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\kcpop.mfx
        • Size 10KB
        • SHA256 28726ae556cbe1e2b4995ab135da1bfc72d0bc4e4f56d821e95dab738eed61a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kcwctrl.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\kcwctrl.mfx
        • Size 79KB
        • SHA256 a0ada42e3a4760097c1c2f98905f12b19de47159543aa21e1c604dbcac7337f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mmf2d3d11.dll

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\mmf2d3d11.dll
        • Size 538KB
        • SHA256 acdc49f4d9581d31ea53940362a08bfa793765f963247c70a6bb6d992f074029
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mmf2d3d9.dll

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\mmf2d3d9.dll
        • Size 1.1MB
        • SHA256 53edf5138930d52b473104ce0d085413248d15a4aa891ac02a718e89625de6ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mmfs2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\mmfs2.dll
        • Size 506KB
        • SHA256 3d89c4fe6c2fa379b203286c9db649ab83f9934ac1be21302057a563a3707563
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mp3flt.sft

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\mp3flt.sft
        • Size 24KB
        • SHA256 ddeafda7b28bf7545e3ba164aa4a74219eb961c36bb974e0f5085a07daf18f44
        • MD5 SHA1 SHA512 SSDEEP TLSH

        oggflt.sft

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\oggflt.sft
        • Size 130KB
        • SHA256 9e589f86317d840df9bb74f6ee20c24ca65afe58f4009740382f63a0f5531941
        • MD5 SHA1 SHA512 SSDEEP TLSH

        parser.mfx

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\parser.mfx
        • Size 30KB
        • SHA256 9813631f63f79fbaa741094786d4b13c34515ec4a33c0d4e88b75a20973c887c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        steam_api.dll

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\steam_api.dll
        • Size 104KB
        • SHA256 fd16fba7a64afdcfcad2a935337432400c8c528e3f210a6672254f75d39bad7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        waveflt.sft

        • Path C:\Users\Admin\AppData\Local\Temp\da5fa3d2-e094-4bbb-b9b8-a465cf650534.FusionApp\waveflt.sft
        • Size 8KB
        • SHA256 92a5053cf5973a6aa228c738d55387f12f1dfa8a837d7b938c60f05b6b56b3ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2708-63-0x0000000003020000-0x0000000003132000-memory.dmp

        memory/2708-57-0x0000000002F20000-0x0000000002F2B000-memory.dmp

        memory/2708-50-0x0000000002EB0000-0x0000000002F09000-memory.dmp

        memory/2708-86-0x0000000003220000-0x0000000003244000-memory.dmp