Analysis
- user interaction
yes - max time kernel
48s - max time network
34s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/10/2026, 14:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
INV.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
General
- Target INV.exe
- Size 4.7MB
- Sample261026-rf8hpsts2m
- SHA256 9e7e6780270c88f32b4a9fcf0884020d046e8dfb0d39c2c351400c042d0a4f82
- MD5 d1d7e9900c54b60e69f6389ae394606b
- SHA1 1a167097cd407370c38a284b8f1589afad665b8b
- SHA512 01086274ce9fce9c6e2e5a7746bedfbc4849fff142ea5ff0a5bcc176d95f16e2f68d5f4eb4f1217efc1ef33a75a9b6f3d5e4c2cb36be03e1e92235fedece89ee
- SSDEEP 49152:bZpP7gV3Ij/r3ZK5kAImbiLIU7aDTqfGuB2csXlHK/bYy55ghvxggq9Qy052Yuwu:QX5kAIm8ODTqO0s1qTYaQvxxxqY1
- TLSH T108360217F3A582EDD42758348AA28B86F3737810171196CF33986659AF5B2F00EBB7D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4016 INV.exe 4016 INV.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4016 INV.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4016 INV.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\NLLoader\cheats.json
- Size 2KB
- SHA256 8f60cc8433690381797a384050325d797faca85af62b0673213d9a54d437f545
- MD5 cf42deb646611f153eef937a01ef8d3e
- SHA1 a1849aacb8fe7a1f397543cfdffa5986cca4dcb3
- SHA512 304797b70ddcc32d99c8b1ff8cba2dab11c84fce6e5c843a921a165b3287daf3f22fb3ac2285a4fba251ff8ae6b71eeca0b9b6714c0bb807713a86523625f8cd
- TLSH T1F951ECB9DC180C92005264739659424336AC14D38ECE3D093BEC6C8C4F6E82E2AFBB4F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\NLLoader\cheats.json
- Size 2KB
- SHA256 622c0833db24579798396b9822e8a6c893b1b67d7585ec443eb98e9fcf612a72
- MD5 a4c6d5f4d008e1354740a288751e8270
- SHA1 9ebf94e7068ba21d18a84d883425593c86293a2a
- SHA512 559bebbb9706cd8b7e04851e037c52f1284faa5aad2e0b1a3e3cccf3780344642f6a112589e0c0a08ca6e000c286df168f3e49c634bdebbad586c6975f1e86ae
- TLSH T1F451ECB9DD140C92104264335659424336AC05D38ECE3D093BEC6C8C4F6E82E2AFBB4F
- MD5 SHA1 SHA512 TLSH