65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba.exe
Size 106KB
Sample261018-rtb2naft6v
SHA256 65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba
MD5 08db70a6121eef63f7862bc2b53c91b4
SHA1 e3206a3a936c460d71f58bc77049d7cb5b796fee
SHA512 8c62fa80c5fe2f4484ba70a9573e9d1b791b38f443e185c082785badcbfd5fb423ce434a66aa436326ec4ad099c579fdd8ac8c1b31771b337d0d092e5f41cb48
SSDEEP 1536:2DV25+olBqRyz0RyNkxwmchmV4arwpE8BbdJdHDGHDFY027+/71d/P:X8Ru0RyN4Agk5dJyJ26Dn
TLSH
T181B31802F75250BAC429C171876B5333A632FC8D1620AB2F1254FA383FB1A565F7DAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 8 IoCs

flow	pid	Process
20	232	Update.exe
23	232	Update.exe
25	232	Update.exe
27	232	Update.exe
28	232	Update.exe
28	232	Update.exe
17	3168	Update.exe
19	232	Update.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3168	Update.exe

Executes dropped EXE 2 IoCs

pid	Process
3168	Update.exe
232	Update.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Update.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Update.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
232	Update.exe
232	Update.exe
232	Update.exe
232	Update.exe
232	Update.exe
232	Update.exe
232	Update.exe
232	Update.exe
232	Update.exe
232	Update.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1744	65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1744	65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba.exe
3168	Update.exe
1744	65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba.exe
3168	Update.exe
232	Update.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1744	65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba.exe
3168	Update.exe
1744	65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba.exe
3168	Update.exe
232	Update.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3168	1744	65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba.exe	86
PID 3168 wrote to memory of 232	3168	Update.exe	95

C:\Users\Admin\AppData\Local\Temp\65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba.exe
"C:\Users\Admin\AppData\Local\Temp\65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1744
- C:\ShaoHua\Update.exe
  "C:\ShaoHua\Update.exe" /oldrun:"C:\Users\Admin\AppData\Local\Temp\65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba.exe" /oldpid:1744
  2⤵
  - Downloads MZ/PE file
  - Deletes itself
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\ShaoHua\Update.exe
    "C:\ShaoHua\Update.exe" /oldrun:"" /oldpid:3168
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Activate.exe

Path C:\ShaoHua\Key\Activate.exe
Size 96KB
SHA256 ca5565c768cbcb9c3381cb2033f71a179a28f0e3e81c484cbc9bb21364ffbf91
MD5 eb033cc3be428dcbc792561e028f54bc
SHA1 5d0854a6c38467fc3c3a096e9a2afb669ac4a31d
SHA512 0de5d2ac29e0515ed7b69fd6bdf1556437b60f441d52210188bb1d8d2a37de9bdb9a7aea49bd92244cb3c67f87cf8ba14a14853ccd6f69fc07654ca64fc75ec0
SSDEEP 1536:+cxsbhExrLuoVpRhNBua8Pov7Uni3zezrx4eKedC9TZhD9LDF+:taaxrL5NhV8gTjMLClhDlQ
TLSH
T1BBA32911F7D214B9C172C6708A7A93336333FA991535AB1F1124A6582E34FD0BE69FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AudioSwitch.exe

Path C:\ShaoHua\Key\AudioSwitch.exe
Size 111KB
SHA256 0486eb9e66a41f68c3289e363eaa9278fc4a285e10c761f28aea903d67b09214
MD5 fea1ae325df39af0279d5bb06af8395c
SHA1 22afd09e6ba8be520adb9276c99d1c630ca419aa
SHA512 3dc1a4afeab290306cef518f513d05be78f0974682e694642b50bf1009412b7a7d0e69baaf8fe5a13e00e45fae9a7f8c35ef34ea0d145c89815199aea6f23952
SSDEEP 1536:m/eimuB2Va+9MYaItIVQTW0uMAYgYnDA+Nx7ANA8jRK80q6HJhm:8ei/M9W0HJDTjANA8lH0LpY
TLSH
T10EB33A12B74690AAC475C13182DBA733B631F4D716306F5F1A2486283E92AB25F7E7CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cleaner.exe

Path C:\ShaoHua\Key\Cleaner.exe
Size 238KB
SHA256 690d35bcc7ac0064927cbc99286469267234daeb6199f0c765a04148a3fce3f5
MD5 2b45b6bd292e90a7ab28b85f17af927f
SHA1 1a5edc85416cce9872d0e4dcb1ca7959d1151d76
SHA512 2dbdca63afeeea8b7ad90ef547cc0ef7cbcb13a0c2dc3a4473a6d6999d8ac85c3107ab63bbd142e30eafb8ba2ab767ee1c5a736560226f9b4343f380469c0d85
SSDEEP 3072:dSniyXJAJ4BTCRxZy/Q8so6CFHnG4lbWyWKliWipzeCbIEnEEfnbvtAb8kQFuD:gn1JAKTCRby47aTJK6COEfblAb4Fu
TLSH
T1B2340816B3E50CB8EB7745B28ABBA731AA76FC501514D70F0608F7196D33E618C3AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DnsSwitch.exe

Path C:\ShaoHua\Key\DnsSwitch.exe
Size 90KB
SHA256 ea3625946b98ba9c23f75f6c63e1aac9b41ba7a175c862947fe35bca5e4211fe
MD5 365ddca25944f91fa24064f954ffd80c
SHA1 5c5c7eecb2245c32f9e9410960ca0180345895f4
SHA512 8e6abbeb1cd0cc2a690c711f3a191abee4a38313ec3e3d54a6409dd62817317c53697d92dfd26b69b7e15186dfc0640c81cbe0c84383f146621f2a52f62d9d58
SSDEEP 1536:yuS07rr30JUFtBSe3UVLWQb4pCaCHDbAa4xk3CLP+:yuBrr3wQORbHBHD8nxT2
TLSH
T11A936B12F74250EEC825C1308B6F5333E733F49A21216B2F1A54D9683FE1D917E6AAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Optimizer.exe

Path C:\ShaoHua\Key\Optimizer.exe
Size 696KB
SHA256 e031b8cf8d90475909777566f3d61bed5c2d3e195990b4a51cafb64bebf8a319
MD5 e147d97047c2cf12caab1fb8a4d53a32
SHA1 deb0eaec5f2463ef08cb964cadd43f6ea919530f
SHA512 022e9b84c7a7bcffe9ebe2d95d199d1bc2099132f7a7efde33fa53c590b16185800f8c76fa2e1935e919beade881aad7bc4a27ab1457c91298af45064b98d086
SSDEEP 6144:P0+amjCBRb5PSVTuS8uWJj0aYHqeqiRswFTJ:P0xmeBRbovO0ZqwFt
TLSH
T102E42D5A67F925D9F7B38B315AB94B22EB32FC722D01DB0D1098020E4D26A55DC31B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update.exe

Path C:\ShaoHua\Update.exe
Size 106KB
SHA256 65abf34f075d459a6bab1f39a219b52aae3abbdd725da32fa98b1d3ca494cfba
MD5 08db70a6121eef63f7862bc2b53c91b4
SHA1 e3206a3a936c460d71f58bc77049d7cb5b796fee
SHA512 8c62fa80c5fe2f4484ba70a9573e9d1b791b38f443e185c082785badcbfd5fb423ce434a66aa436326ec4ad099c579fdd8ac8c1b31771b337d0d092e5f41cb48
SSDEEP 1536:2DV25+olBqRyz0RyNkxwmchmV4arwpE8BbdJdHDGHDFY027+/71d/P:X8Ru0RyN4Agk5dJyJ26Dn
TLSH
T181B31802F75250BAC429C171876B5333A632FC8D1620AB2F1254FA383FB1A565F7DAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Update.exe.new

Path C:\ShaoHua\Update.exe.new
Size 106KB
SHA256 4916133c3720d53efc61a3624cb186599e7179ec5218f3b46d30c3d36dc07914
MD5 101ef55c60e11c5fc14d8826ebc4ec4d
SHA1 2fd3451cdeed89b168f93022f7c4f491d1a5f359
SHA512 2ecf641a87c4976d68130bcc44e860a668e601baba5c637e6e91d0d7dc786c851e42b0d598d65221a1c2496fe7660597c32e321888da2ade9c3801dfad354309
SSDEEP 1536:XDV25+olBqRyz0RyNkxwmchmV4arwpE8BLtJdHDGHDFY02X+/71d/8:S8Ru0RyN4AgkptJyJ2ODE
TLSH
T133B31802F79250BAC429C171866B53339632FC8D1620AB2F1254FA383FB1A565F7DAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1A8B20F9F1F4F59A0098779C25B79A00_C30198FE36564BB14717F98C836EBCF0

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1A8B20F9F1F4F59A0098779C25B79A00_C30198FE36564BB14717F98C836EBCF0
Size 1KB
SHA256 c675b5a6993d8b94dcfb449e27a9130c137d456bb88d5639a6b845aa1c9aba15
MD5 28c690b88a58d6aa536f7a43c0e6d7ff
SHA1 8e5e9e841898a023ad7e7e0e4c815bfced2862df
SHA512 cd5aa96f80830837a41f882448c5e0c848b54cc922fadd926f75ab581d2dbf113a82a29ce13dcf510f31b8576e845039ba3a7df60bf6c2f9ef78300356c8bf11
TLSH
T17E41E8194FA83525EE1D3D4C52CE8B1B6C9E82CA2914B18A743C40516C212BB7A7F90E
MD5 SHA1 SHA512 TLSH

Submit Download

1B7671A5957918453A16C5C15634EFED_5A5015EDFB513B5686006384177FAF53

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B7671A5957918453A16C5C15634EFED_5A5015EDFB513B5686006384177FAF53
Size 1KB
SHA256 53520f0f45c6de091b2424aa5553c6a80beec15b61ac699692f2db5535d487bd
MD5 eb4717a5a1535aa74477d6191faf9d61
SHA1 4f38788fc1e75014cf4ecd9c8ce401547e3efba7
SHA512 acecfc04bbddd3551a63d48d9501170850249a94ef57fc1115b3a53c65d7f416173590d6f4177c4bf11b2d08e621d052555f60d42d8c3c4b02be3961d9c7353e
TLSH
T18A3183255BA138A01E920D811FDAE62DDDB464C618604442307DDBD69DD3BBB3E6941E
MD5 SHA1 SHA512 TLSH

Submit Download

BC1780AD24BB05AC5F1BD945BBFD6FB8_DC1C6BB34E8F81848BE8DD48D727174E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC1780AD24BB05AC5F1BD945BBFD6FB8_DC1C6BB34E8F81848BE8DD48D727174E
Size 1KB
SHA256 890da45a684f96eaeae650a1a83bd9673c1d171c7116d75e9aae49801c42ed6c
MD5 d565641944823db3f95d01867789642d
SHA1 14a24d01b2206b4cc8c37c453b20eff9f7f6efa2
SHA512 6335d486c9aec0b80dd3e24dd6127fd13f3fbde662a3aa80dcc512aff190a7e0be82f5b8b47d681b177327f11d3f782fafaf7d55631930dc1c7146ba466cc4cd
TLSH
T1CB41D8595B292866BE1BD9A93D49833B08D0A2D09CC71AC41DA4006A5DD8AF6574501F
MD5 SHA1 SHA512 TLSH

Submit Download

1A8B20F9F1F4F59A0098779C25B79A00_C30198FE36564BB14717F98C836EBCF0

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1A8B20F9F1F4F59A0098779C25B79A00_C30198FE36564BB14717F98C836EBCF0
Size 468B
SHA256 6c63123a6545fe3f78b3ddcd31eae74fd4aa40734081a107bd4f367d37695256
MD5 b66bdfb1c9f4341b0bf535edad0c04e2
SHA1 94af9cb58c661a82a543e5938639de92f5e45e2d
SHA512 a859874403665523aa385154eb3f1addd7223f6d83811b5a6cdb6c6513562da12577ae281022fa51d2ed31f1ec1c990e1020e7d3445fa821f588c8c50517eb5b
TLSH
T1F0F055241AFF005DF172E8BC83CD2960C209F2A6240082AA43ECC109262BC04AC33912
MD5 SHA1 SHA512 TLSH

Submit Download

1B7671A5957918453A16C5C15634EFED_5A5015EDFB513B5686006384177FAF53

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B7671A5957918453A16C5C15634EFED_5A5015EDFB513B5686006384177FAF53
Size 408B
SHA256 4af9a141d09db4f66fd20cd4fcba743f130dc0f8d345277689bf200f61907264
MD5 4b977cfaa90f4a5183fceb4d836f7ed7
SHA1 3a32ee7afd7669566d85e215b84ebee92603c2ce
SHA512 e00d0138bd012e0c982cbf5e2cde2b4ca378bbca173ec587900d4a6492e7ae1644229f905ab66a641579394c16c61a7c6e965c855697c5b38500805d7983b2dd
TLSH
T1DDE0C634A2EE007EF630D1FC0ACE37940A36F533250A2AF24AA066023E28D801C76CB1
MD5 SHA1 SHA512 TLSH

Submit Download

BC1780AD24BB05AC5F1BD945BBFD6FB8_DC1C6BB34E8F81848BE8DD48D727174E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC1780AD24BB05AC5F1BD945BBFD6FB8_DC1C6BB34E8F81848BE8DD48D727174E
Size 456B
SHA256 c7cc867fe0e9dca43c2a650afe1afd7fc2de54539854e372c9421b1ec4fdc06d
MD5 d9e0263bfcf2a641331ed8877c1dd280
SHA1 1661a9348ae9bd424215d88308def5e65936f9bc
SHA512 4f6b4832c329bc6007300e45d44ffc48e04842352a4229a9b1c64061c6be3882dfdfaa0277450122ca42ad4106f7a8b2693a149834b9e92de79712f7390c13f3
TLSH
T100F02B1026F8029EF775ADB945DD6553D51BF2873500D7BA1B76920A3A0A8418833A6A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/232-40-0x00007FF77D0D0000-0x00007FF77D143000-memory.dmp

Download

memory/232-53-0x00007FF77D0D0000-0x00007FF77D143000-memory.dmp

Download

memory/1744-5-0x00007FF63E5B0000-0x00007FF63E623000-memory.dmp

Download

memory/3168-24-0x00007FF6B17B0000-0x00007FF6B1823000-memory.dmp

Download