fb7a56578b5fd84c56d4f4e64d4fe218547174532bbcfb7d8d7c0cbfc19dec5f

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fb7a56578b5fd84c56d4f4e64d4fe218547174532bbcfb7d8d7c0cbfc19dec5f.exe
Size 1.8MB
Sample261011-jf8jpseb56
SHA256 fb7a56578b5fd84c56d4f4e64d4fe218547174532bbcfb7d8d7c0cbfc19dec5f
MD5 03827078edf4629d7da7e02446fe3ec9
SHA1 4121dbb27ec3182df3ff610eab2128e7d17feca4
SHA512 ac4dc0fc69dade0d9cf473ae093d4105f7cf9f65cb30cdec6f5e9af8e3cff77ad21b0e8140fa0c91f543d4aba0e38fe69c2014104aaacb4ae2baeb0aabe5e938
SSDEEP 24576:i4myzomtkwEhCBRLmJ3p0oNtzoZ5YYGG4bRbiWCqUW4qBGsRNLemzG+5LhortwDi:inmGfCu3ptv8GfbRb02DxbB51cCoZ
TLSH
T13B95E00102C245EFD7329B712D463261860F9C8EFCAA6DA6DD17F67518FE92604FA60F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1064	fb7a56578b5fd84c56d4f4e64d4fe218547174532bbcfb7d8d7c0cbfc19dec5f.exe
4584	Un.exe

Loads dropped DLL 5 IoCs

pid	Process
4584	Un.exe
4584	Un.exe
4584	Un.exe
4584	Un.exe
4584	Un.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Un.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb7a56578b5fd84c56d4f4e64d4fe218547174532bbcfb7d8d7c0cbfc19dec5f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb7a56578b5fd84c56d4f4e64d4fe218547174532bbcfb7d8d7c0cbfc19dec5f.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4584	Un.exe
4584	Un.exe
4584	Un.exe
4584	Un.exe
4584	Un.exe
4584	Un.exe
4584	Un.exe
4584	Un.exe
4584	Un.exe
4584	Un.exe
4584	Un.exe
4584	Un.exe
4584	Un.exe
4584	Un.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 1064	924	fb7a56578b5fd84c56d4f4e64d4fe218547174532bbcfb7d8d7c0cbfc19dec5f.exe	85
PID 1064 wrote to memory of 4584	1064	fb7a56578b5fd84c56d4f4e64d4fe218547174532bbcfb7d8d7c0cbfc19dec5f.exe	86

C:\Users\Admin\AppData\Local\Temp\fb7a56578b5fd84c56d4f4e64d4fe218547174532bbcfb7d8d7c0cbfc19dec5f.exe
"C:\Users\Admin\AppData\Local\Temp\fb7a56578b5fd84c56d4f4e64d4fe218547174532bbcfb7d8d7c0cbfc19dec5f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924
- C:\Users\Admin\AppData\Local\Temp\fb7a56578b5fd84c56d4f4e64d4fe218547174532bbcfb7d8d7c0cbfc19dec5f.exe
  "C:\Users\Admin\AppData\Local\Temp\fb7a56578b5fd84c56d4f4e64d4fe218547174532bbcfb7d8d7c0cbfc19dec5f.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe
    "C:\Users\Admin\AppData\Local\Temp\~nsu1.tmp\Un.exe" _?=C:\Users\Admin\AppData\Local\Temp\
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0e58e896.tmp

Path C:\Users\Admin\AppData\Local\Temp\0e58e896.tmp
Size 5.2MB
SHA256 e9bab7d90f13d28fd6c5059e3f3b2ce774a242e862cbf1d09426863f72113c4a
MD5 a1e2d0e1647df5c7e6353f41ad373d70
SHA1 46393c4342b1756155f8598028953525fce9ba4a
SHA512 ccfd897b6947984638d79689d86fb62e22f6cb8de17234fd72c52248eb293e1b13bf744ecb087f760d72bfc52120d5aa18e67d4189fee6da7c35af89c20e35c9
SSDEEP 49152:puTUBdPOFhYSCRrb/TWvO90d7HjmAFd4A64nsfJalw/SDI4LsTC064Pgasvccmnz:3OFhMDOI1sJkF1KaxlA+qvn3cqf6oU
TLSH
T1D7467C03B89550E8CAEED230897A4252B7717C890F3167D32B65B7B92E337D85E39394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e58e896.tmp

Path C:\Users\Admin\AppData\Local\Temp\0e58e896.tmp
Size 132KB
SHA256 637873254eba2bf8ea16418bec897123ea6dd59a2d037fd233a6127b366f9668
MD5 c4ec0953f67b7fe94a6907de55e2ba20
SHA1 5aebece94717e6901a6558998b5d4a9d38a99219
SHA512 a631cb9643dae189b441105fd0c33f72092473deccb1bbe7782535c547428daa97c128e60ff5bbc7e3138810f6ac8fc7139ec7365932a7cbc09e98736893aaeb
SSDEEP 3072:KAkZSbwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwR:K4wwwwwwwwwwwwwwwwwwwwwwwwwwwwwB
TLSH
T1B7D3780102C251EFD3329B702D463261964F9C8EFDAA6D62CD17F67558FE86A04FA60F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb7a56578b5fd84c56d4f4e64d4fe218547174532bbcfb7d8d7c0cbfc19dec5f.exe

Path C:\Users\Admin\AppData\Local\Temp\fb7a56578b5fd84c56d4f4e64d4fe218547174532bbcfb7d8d7c0cbfc19dec5f.exe
Size 1.7MB
SHA256 714c92833a62026584626c736cbd66b7093d6ab909e6a92d2bc8eb24b2ab95b1
MD5 11be8caa60740610538b885aa016962d
SHA1 05a9f9db0e78722d8a3acb4f16a1e2c946359192
SHA512 0d9c683c5713818c4236b06eb2ae5b15d9c98ce653644a249ef97cfbe43cb792ddadf89808ae5ba29112ad1b03abfe5b3017ae83e5672020ad26c65d10477e3d
SSDEEP 24576:i4myzomtkwEhCBRLmJ3p0oNtzoZ5YYGG4bRbiWCqUW4qBGsRNLemzG+5LhortwDi:inmGfCu3ptv8GfbRb02DxbB51cCoZ
TLSH
T11885020102C245FFD7329F712D463252860EAC8EFC6AADA6DD53F6A118FE92544FE50E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nspEA4C.tmp\FindProcDLL.dll
Size 492KB
SHA256 bda8e0ddb672ea3558ad68634c49da06cd72f93d7fca642ca41df00e26512df1
MD5 633625aa3be670a515fa87ff3a566d90
SHA1 de035c083125aef5df0a55c153ef6cc4dd4c15b4
SHA512 3c687ddf0e4e93a6787a23a93e2011df42898f6d21101c848a1b7c7bd2eddd5d49fdd0748e47e6235e7808596d00a1ecf79b5c975d050dd8d00a95f515a444a9
SSDEEP 12288:LAeafIS4J8anXexYWGRhvgbTu4RJ6//sCMUx:04J9/WGRS33+
TLSH
T156B44B00B660C01DF4FA00F9D2BAA95DAA1979B0573C94CBA1E5F6CE07395E5AD33393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nspEA4C.tmp\System.dll
Size 12KB
SHA256 1d0ff7a0b131aca891833a39eb5771f77ff595d91f00102071661b8d00888555
MD5 a08c2581acfe27b4f8797c34b0043bb7
SHA1 370ab892cc8805e53e82a69c197b97499b49c0d1
SHA512 e4ea98f5c282c2051e5138063416f14bc3f1449c6bf5eebd2486d0c1190a1fbc20a87651bb96b8e98df7697a49043695d1d6f7a59953ccccb00326bd2eb70976
SSDEEP 192:ycT+SdpWQVDZ0VeqeUCFRJYTkvBo9LnNWNkRHE1MMSm:f+85GVesCFR8kJo1nE0E1Nl
TLSH
T1BD423943BF614AF2E9554736046A7F1B4B3CEE5503D4469BCFD39444A8B10E324396E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WeChatInstallDll.dll

Path C:\Users\Admin\AppData\Local\Temp\nspEA4C.tmp\WeChatInstallDll.dll
Size 3.4MB
SHA256 fdae19ace7a6f411b08effef7cb2c482bc6489964a15e276281f8e40b2d75fd4
MD5 d66d83c3b3051211b5b9e7854e22f0ce
SHA1 1acc2d9abb621aabc6127c6b76a65f835e207139
SHA512 2740a058708bf9a81c7561a9e0dee423e69501e5358515c85c3aaa0bf3e26e82a8c087689515ebd3e174f120f046b93816c14f87476e231099721cc53b343c7f
SSDEEP 98304:aW/+542YdKDelbPqx55PPwiLR5md9LyNY:aWG54awi5qd9+N
TLSH
T1F2F5C002FB82D272E59A0274617767BB4DBD6E30A73588C3D7E03D7588305E2663A35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4584-52-0x0000000010000000-0x00000000100AB000-memory.dmp

Download

memory/4584-57-0x0000000010000000-0x00000000100AB000-memory.dmp

Download

memory/4584-62-0x0000000010000000-0x00000000100AB000-memory.dmp

Download

memory/4584-63-0x0000000010000000-0x00000000100AB000-memory.dmp

Download

memory/4584-64-0x0000000010000000-0x00000000100AB000-memory.dmp

Download