Analysis
- max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/10/2026, 04:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
56f84d7aefb4a84dda1afc8b25093907ca427162f0be9d9241141c98980af04e.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
56f84d7aefb4a84dda1afc8b25093907ca427162f0be9d9241141c98980af04e.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 56f84d7aefb4a84dda1afc8b25093907ca427162f0be9d9241141c98980af04e.exe
- Size 13.3MB
- Sample261011-e8wcmady6k
- SHA256 56f84d7aefb4a84dda1afc8b25093907ca427162f0be9d9241141c98980af04e
- MD5 c31c7f2645ddfad29d0bf061c8da46c9
- SHA1 cd27dab3008374f7b70fae45cce0e431707085f8
- SHA512 da83f3cdcb262497d5a7b8de9cbec9853121d1a5f4722cb7747d4966144ac7e6a3b963f0c0b66b5167b16bbdc0a298e609e76c983b779679de9857f576fae39d
- SSDEEP 196608:CBfS27kDd/TEmCNL3akpI/Ml94/xZ+/He58OJOXYpXMiDSUX+dmGxLI9N2LtBq5o:ifK/TEmK4Zb+/Bq9XJuIi225cJC9
- TLSH T1EFE622F651E25CCBD46368FC91A44E06A175DFEC0B4202D15788EAAC7BB6E436AD13C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation 56f84d7aefb4a84dda1afc8b25093907ca427162f0be9d9241141c98980af04e.exe - Executes dropped EXE 1 IoCs
pid Process 1632 CManager-installer.exe - Loads dropped DLL 8 IoCs
pid Process 1632 CManager-installer.exe 1632 CManager-installer.exe 1632 CManager-installer.exe 1632 CManager-installer.exe 1632 CManager-installer.exe 1632 CManager-installer.exe 1632 CManager-installer.exe 1632 CManager-installer.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 CManager-installer.exe - Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
pid Process 1400 wmic.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname CManager-installer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain CManager-installer.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56f84d7aefb4a84dda1afc8b25093907ca427162f0be9d9241141c98980af04e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CManager-installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1632 CManager-installer.exe 1632 CManager-installer.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1400 wmic.exe Token: SeSecurityPrivilege 1400 wmic.exe Token: SeTakeOwnershipPrivilege 1400 wmic.exe Token: SeLoadDriverPrivilege 1400 wmic.exe Token: SeSystemProfilePrivilege 1400 wmic.exe Token: SeSystemtimePrivilege 1400 wmic.exe Token: SeProfSingleProcessPrivilege 1400 wmic.exe Token: SeIncBasePriorityPrivilege 1400 wmic.exe Token: SeCreatePagefilePrivilege 1400 wmic.exe Token: SeBackupPrivilege 1400 wmic.exe Token: SeRestorePrivilege 1400 wmic.exe Token: SeShutdownPrivilege 1400 wmic.exe Token: SeDebugPrivilege 1400 wmic.exe Token: SeSystemEnvironmentPrivilege 1400 wmic.exe Token: SeRemoteShutdownPrivilege 1400 wmic.exe Token: SeUndockPrivilege 1400 wmic.exe Token: SeManageVolumePrivilege 1400 wmic.exe Token: 33 1400 wmic.exe Token: 34 1400 wmic.exe Token: 35 1400 wmic.exe Token: 36 1400 wmic.exe Token: SeIncreaseQuotaPrivilege 1400 wmic.exe Token: SeSecurityPrivilege 1400 wmic.exe Token: SeTakeOwnershipPrivilege 1400 wmic.exe Token: SeLoadDriverPrivilege 1400 wmic.exe Token: SeSystemProfilePrivilege 1400 wmic.exe Token: SeSystemtimePrivilege 1400 wmic.exe Token: SeProfSingleProcessPrivilege 1400 wmic.exe Token: SeIncBasePriorityPrivilege 1400 wmic.exe Token: SeCreatePagefilePrivilege 1400 wmic.exe Token: SeBackupPrivilege 1400 wmic.exe Token: SeRestorePrivilege 1400 wmic.exe Token: SeShutdownPrivilege 1400 wmic.exe Token: SeDebugPrivilege 1400 wmic.exe Token: SeSystemEnvironmentPrivilege 1400 wmic.exe Token: SeRemoteShutdownPrivilege 1400 wmic.exe Token: SeUndockPrivilege 1400 wmic.exe Token: SeManageVolumePrivilege 1400 wmic.exe Token: 33 1400 wmic.exe Token: 34 1400 wmic.exe Token: 35 1400 wmic.exe Token: 36 1400 wmic.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1632 CManager-installer.exe 1632 CManager-installer.exe 1632 CManager-installer.exe 1632 CManager-installer.exe 1632 CManager-installer.exe 1632 CManager-installer.exe 1632 CManager-installer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1800 wrote to memory of 1632 1800 56f84d7aefb4a84dda1afc8b25093907ca427162f0be9d9241141c98980af04e.exe 90 PID 1632 wrote to memory of 1400 1632 CManager-installer.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\56f84d7aefb4a84dda1afc8b25093907ca427162f0be9d9241141c98980af04e.exe"C:\Users\Admin\AppData\Local\Temp\56f84d7aefb4a84dda1afc8b25093907ca427162f0be9d9241141c98980af04e.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\CManager-installer.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\CManager-installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic baseboard get SerialNumber3⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1400
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\CManager-installer.exe
- Size 2.8MB
- SHA256 9c58953501807d2bc3271bc843387660edfb65f2be619d432de369c1483a3a3b
- MD5 e856adfeed2e8df4d9384e3c9c28ff87
- SHA1 759e31d82d59d3ffe407bf6acdb18bb99875b260
- SHA512 14babfb2c5dab04be6e82b65e2c99ef1a1715dc0e47f7dbfbb02f3819870253008d8238259cbd1dd4c153c39aad85d76efc5b42ffe78694f279e6d96319a0381
- SSDEEP 49152:BJdaGElJDQbgT8PIreOBWBrVunAYqURScNqxlrHwcJ:BJdaplJDQbgT8PIreOBWZVunU9ckxl
- TLSH T11CD57CF26A96889BD85300FD45948EEA8135CFBC0B5610D393CCE7997679EC32E71683
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\LIBEAY32.dll
- Size 1.4MB
- SHA256 e1fbb97ff3607d569d584f78ce77a9dd2cf64dca05aebdbf3e55c9711e07b3be
- MD5 ff5c63efbba91a0eec9fc645da655b4c
- SHA1 d225ceff3601b57add69df7d854b2348a8980255
- SHA512 96b963823d7a28e4d4ecd703aa26ad3d3e1d4086e09a4cc08ca88c30c9b8ceb42b7daf184e33b9175f87a566e78028cca3e6ab90ed6537598677f27b15eefce5
- SSDEEP 24576:bP7+KpPGpFwdp51AaHUzrFEUrCrhRgh4fnrvjHnhPUShTuTjCjstP/TqBlkcULQw:7t51AV4/gh4fvpvuOjstP/TqIcULQ3A
- TLSH T156659E07BF8199B2E5CF823C91B7977E9D3659119324C9C3CAA129A5CC316E0673F389
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Qt5Core.dll
- Size 4.4MB
- SHA256 3e7e16ff324e9a601f56560bd5130066690e505ee87466d15abb30191c747eb2
- MD5 879ca2ca37fe7f349a05171a9980701c
- SHA1 9d8e0eb12bbcb356f69f98a0f9561d57ac46f4a7
- SHA512 06241adaf5f64b4445ed3b6f6228d6f0477e381dab7ec1b0103185b603e8b20ab6976066e225d28436c4cd7144cc21e684ead90d47f10ad189db16d8a133a1dc
- SSDEEP 98304:yywCaniFUp+Fb0XX/DBB0Jsv6tWKFdu9CfD:Q9SkboJsv6tWKFdu9Cf
- TLSH T106267DB2A756C636FAD692768C6AD72B0035FD150B1585CBF38C361968306E23F3B14B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Qt5Network.dll
- Size 832KB
- SHA256 24d9de8928483b430ab58ade592569d3cf8c16afea86222fbcedeef574379fe1
- MD5 4cda8d643b69a4bf252c72f59d60f0de
- SHA1 6f9b3bb2c222f54b9917c2a7e6d2d81c2cbf8aa7
- SHA512 c07f2ea6fc73d44775343df4b2ee97ad135d64c15826de77d7c024ae9ff68f8f210dd2e88b8b1701e8483f8745f23c706420d86fc568a18d18a48c23be3dbca5
- SSDEEP 24576:KQfXvRE8SGqeoZfY7jOYOve9yQxRmEvjO:KQfXvQ4ouPKveIQZbO
- TLSH T105053A52B34B01A2E95843B7851DAF6BE13DF1154B32C7C7B3199EB6A0632D27A3D1C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\msvcp140.dll
- Size 437KB
- SHA256 97e71a3c697fb1ab3af777db39009e4602525e8c3aff0837ecc7031cba188165
- MD5 cbf2f368dae5e7dcf338c6f63533a2a9
- SHA1 66ed78a01447a005bf1bb5a3950a3e9b728972ca
- SHA512 3fedbd8819f2f33ccfa537eea3450157ff445eedaeb8a069d453e22726eb3b90a3c93f8069845fe9dc0ff39d9f4ff71209f61c66aeb5dbb7590d47a91641944a
- SSDEEP 12288:zm0Gxo1x5zvNk5/IQUG2MiwB19uaCOmhUgiW6QR7t5s03Ooc8dHkC2esGyadKN:ztR1x5zvNkfp2MiG1303Ooc8dHkC2eX0
- TLSH T1679417227B060DF1E49923B572CA431293F9EC6503A0E3C393DEF5196F662C6A773691
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\sciter.dll
- Size 14.6MB
- SHA256 c1657a4f84fe744dcd8c348d07cb0ed108a2ce189ee35b22361133d5fac3013e
- MD5 f970060fb91764cdaa963dfd24df570c
- SHA1 67c9636a556dee8ad7952daee2b9b9b0d7de50a7
- SHA512 a56609c84076ca1895fc7ba4738005ef393cca1138d37da19f9224f74843083795b8cc6583fc0e797f968177117318ab32c9241a0c31434c2654b893fef21a32
- SSDEEP 393216:27+qPWgWJBr3ptJHgqitzW+HWv+SPAMNiN5E:DbLJHgPW5vn5
- TLSH T1EAF6BE22BA91C0BDC51E03709D0DF79692BDAE700BF182937AD83ACDAF715D07A56613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ssleay32.dll
- Size 371KB
- SHA256 f3a288c5455b074fe9c9d5a160adeb49e84bbe1832b5fcbe8f26093215192f65
- MD5 7456818a22dad2c0965580d8bbf4cabd
- SHA1 548714607df2ec3b7c8a22cfba3a1776e6e80861
- SHA512 13f6589bd9c0c60a3df63325c57e94129761adc558d1a65eb4c6e138e6155dd9dbe501d45edde282219dc357593458f5f84a29188d123dcb7770e7479f6a7e68
- SSDEEP 6144:ei2wWNZIpLE8b643WlU03dn3Hg460la0C1bDTQ90IVgcQ7Ab/NXXN7zKDhz+Pi8O:x2wWNZIpLE8b6mWlU03d3Hg460laf1ns
- TLSH T19D848E03F68181B3E89A4B74317B6BB62D3E6A015B65C5D3CF60696C8D313C0A73DA9D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\vcruntime140.dll
- Size 89KB
- SHA256 a9d7732a3c3de09f0601a7fa2555093dcb49f08e2fc62a86091461f0f38393ed
- MD5 4bea1ba68690620b78c7502ac968f0ba
- SHA1 acdc523fa28632fcecede3eeaf62c6bce26527b4
- SHA512 d451625494b54b96a481d34f5b42b9c631810558267e8b37b182fe09583422f1c1171a922c9abfe4227ee91f430f3579e8ab8173234264a435fdcfa6a16ce57e
- SSDEEP 1536:WJJFW1PcUMCdLiNWNrjO+MT+S0OeneLDA50Xsd2zkkBGCGVbBBTkfeecb6RWSwgZ:I3W1P/MCdnQ+8EWXsd2ARNBPecb60Swo
- TLSH T10C937E9375F881B2D99E05B0D9BBFB161D3DE6410FF06BD71B949844DEA2BC09B3021A
- MD5 SHA1 SHA512 SSDEEP TLSH