fb50ea0f6c0024d19bac40ee98a9849f987e826d077c2d8698f55408e8ee5a20

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fb50ea0f6c0024d19bac40ee98a9849f987e826d077c2d8698f55408e8ee5a20.exe
Size 6.9MB
Sample261012-2g62dafa39
SHA256 fb50ea0f6c0024d19bac40ee98a9849f987e826d077c2d8698f55408e8ee5a20
MD5 18e07632546253b651f8eb86b3118d9d
SHA1 f43064d09ea9520053b7311e149cc5d8302825cc
SHA512 2d380c46abdf2f53dd8ede4b72dc23e5f8f984375a5f94e2445a41b194849210fea733d929ce4e2d297325e1454eb06b00c26c7a4ee14d303f3d5fa1e27afeeb
SSDEEP 98304:o036/dof5/FgbZ/o9M5o5DmOBRbMahkjL2LAQEySpJJ++d2om/xoV1p:o0q1+/iZ/2MCxbiH2LARySpjZAow6p
TLSH
T1CA763309E2C948EDE1B3D2384C168C15CB737C151BB5DD6F2790879A6F37260AC7AB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2660	AFUWINx64.exe
3808	amigendrv64.sys

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3260	cmd.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 3260	4132	fb50ea0f6c0024d19bac40ee98a9849f987e826d077c2d8698f55408e8ee5a20.exe	87
PID 3260 wrote to memory of 4112	3260	cmd.exe	89
PID 3260 wrote to memory of 2660	3260	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\fb50ea0f6c0024d19bac40ee98a9849f987e826d077c2d8698f55408e8ee5a20.exe
"C:\Users\Admin\AppData\Local\Temp\fb50ea0f6c0024d19bac40ee98a9849f987e826d077c2d8698f55408e8ee5a20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\System32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FirmwareUpdate_NVE2eMTN\AfuUpdate.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\system32\chcp.com
    chcp 936
    3⤵
    PID:4112
- - C:\Users\Admin\AppData\Local\Temp\FirmwareUpdate_NVE2eMTN\AFUWINx64.exe
    AFUWINx64 WN35B.bin /P /N /B /CAPSULE
    3⤵
    - Executes dropped EXE
    PID:2660

C:\Users\Admin\AppData\Local\Temp\FirmwareUpdate_NVE2eMTN\amigendrv64.sys
C:\Users\Admin\AppData\Local\Temp\FirmwareUpdate_NVE2eMTN\amigendrv64.sys
1⤵
- Executes dropped EXE
PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AFUWINx64.exe

Path C:\Users\Admin\AppData\Local\Temp\FirmwareUpdate_NVE2eMTN\AFUWINx64.exe
Size 1.1MB
SHA256 535633b1c097581f34d31c3e2b9c594779c6e88dfd52cf3c02ac72c1b3e6649b
MD5 594f1cd95d6bfc78b7991d097101823d
SHA1 6e4f81245623094d183a59fd1cca287abef429db
SHA512 d71c0477776a128c7064061dfc5fa5c11b488f03e75da68e6c18dc99b0c1525f9e2fb17a4b4702993633fc9247c45e0a64d3f969c4a6a882ea5b2a352d34a6a3
SSDEEP 24576:2p0UgUuysa9KjxeB/+FADIsVYGtBFyQo1:2XoOKjxeB/gEI1GtI
TLSH
T1D1352A4BE7E721E9D876D0388593233AF9B078648338DBD7978449160B32BF4A63E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AfuUpdate.bat

Path C:\Users\Admin\AppData\Local\Temp\FirmwareUpdate_NVE2eMTN\AfuUpdate.bat
Size 611B
SHA256 1ab83ab1415813e8c89f776de7fa3108b315eaed6bfb32e15873aec35b4aff95
MD5 a660428887a603c13c768c73cb1540f5
SHA1 54926be894440ab99117a507854a50e2220a7cb4
SHA512 8d2474258d6323c817d1b6b370a9b8d7ef2d030df11a67e42dfeecd9ee8f88ae2860bfe9496ddbca1fa60e2aeda241dea7cf0c0ea41ff6b15d5b1ba93708dc35
TLSH
T1AFF0AC26350341BB6279817747AC148FF6D7839B041FB6F5B986D0500F36C885CD9ADC
MD5 SHA1 SHA512 TLSH

Submit Download

amigendrv64.sys

Path C:\Users\Admin\AppData\Local\Temp\FirmwareUpdate_NVE2eMTN\amigendrv64.sys
Size 36KB
SHA256 4892914632d4a8c327e6963b8a841266d6cdc466af03603b99d486799d947b64
MD5 e5279a3d6b486515eb9e5e7ffd77e755
SHA1 e6148b777aca136c7a645bd71ba7bfe8272324bc
SHA512 073ce8938e44f24a013235cd8317b157a5a8c9324225f91358fce031e3cdb1f7c863aaf2604dcc26715e29af9c2db66d8a1621fd9ca1fd985a73d3738784769d
SSDEEP 384:hrzh6yxjyRvlueQnk7r8FR1jdpwK3C4tBtjldei2WSx7bLfSHoxFRMQq/R9zZPFl:FxxjKlu5YKK4rkAmbLYcMQU9zZD
TLSH
T154039EC3273824C2ED8E8974D2D9DBB7ADB4B7912B1196C701B0D1545E62BC27B3922F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads