0a825fb57b9361688d445ed4b23f45d2b36ccfd035f5bcca4f845fa9faf63c5d

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0a825fb57b9361688d445ed4b23f45d2b36ccfd035f5bcca4f845fa9faf63c5d.exe
Size 2.6MB
Sample261027-e3jfwaav6w
SHA256 0a825fb57b9361688d445ed4b23f45d2b36ccfd035f5bcca4f845fa9faf63c5d
MD5 31737b3a6e982098a440214657acdd7d
SHA1 91f9cebc13fd9ad82d3a49b7758e78571185bf19
SHA512 83c438c124eefab90f6cec3f1d69d15282a8e7c84e40264fced50559b98f5893ff6d57c4e7a200c862ef3c6a2fd21b384094c3c8b50ae4a97f4bff5b35609067
SSDEEP 49152:gkmKRQ4fpwh36I0UiNAX1N30qjhSkdw0K7BDrzrOAdK9Hva4:gNDj36I0UiwN31j9W0K7BDrzrOKK9HC
TLSH
T11BC5BDC8A440A7EFE31034B1798E8AF1751A375F9B3DBD35A4C1047820BFC79A565CAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1392	kfomwyfyun.exe
3532	kfomwyfyun.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\XYRadish\unins000.dat	kfomwyfyun.tmp
File created	C:\Program Files (x86)\XYRadish\is-UAC3N.tmp	kfomwyfyun.tmp
File created	C:\Program Files (x86)\XYRadish\is-1TOCI.tmp	kfomwyfyun.tmp
File created	C:\Program Files (x86)\XYRadish\is-D58K6.tmp	kfomwyfyun.tmp
File created	C:\Program Files (x86)\XYRadish\is-GI8OM.tmp	kfomwyfyun.tmp
File opened for modification	C:\Program Files (x86)\XYRadish\libEGL.dll	kfomwyfyun.tmp
File created	C:\Program Files (x86)\XYRadish\is-IFMMF.tmp	kfomwyfyun.tmp
File created	C:\Program Files (x86)\XYRadish\is-AUS6B.tmp	kfomwyfyun.tmp
File opened for modification	C:\Program Files (x86)\XYRadish\unins000.dat	kfomwyfyun.tmp
File opened for modification	C:\Program Files (x86)\XYRadish\ScreenCapture.exe	kfomwyfyun.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1448	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a825fb57b9361688d445ed4b23f45d2b36ccfd035f5bcca4f845fa9faf63c5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfomwyfyun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfomwyfyun.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x0009000000019cb3-6.dat	innosetup
behavioral2/memory/1392-9-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral2/memory/1392-50-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2420	0a825fb57b9361688d445ed4b23f45d2b36ccfd035f5bcca4f845fa9faf63c5d.exe
2420	0a825fb57b9361688d445ed4b23f45d2b36ccfd035f5bcca4f845fa9faf63c5d.exe
2420	0a825fb57b9361688d445ed4b23f45d2b36ccfd035f5bcca4f845fa9faf63c5d.exe
2420	0a825fb57b9361688d445ed4b23f45d2b36ccfd035f5bcca4f845fa9faf63c5d.exe
3532	kfomwyfyun.tmp
3532	kfomwyfyun.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3532	kfomwyfyun.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1448	2420	0a825fb57b9361688d445ed4b23f45d2b36ccfd035f5bcca4f845fa9faf63c5d.exe	89
PID 1448 wrote to memory of 1392	1448	cmd.exe	91
PID 1392 wrote to memory of 3532	1392	kfomwyfyun.exe	92

C:\Users\Admin\AppData\Local\Temp\0a825fb57b9361688d445ed4b23f45d2b36ccfd035f5bcca4f845fa9faf63c5d.exe
"C:\Users\Admin\AppData\Local\Temp\0a825fb57b9361688d445ed4b23f45d2b36ccfd035f5bcca4f845fa9faf63c5d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\kfomwyfyun.exe" /VERYSILENT
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Users\Admin\AppData\Local\Temp\kfomwyfyun.exe
    "C:\Users\Admin\AppData\Local\Temp\kfomwyfyun.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\is-RGO05.tmp\kfomwyfyun.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-RGO05.tmp\kfomwyfyun.tmp" /SL5="$6011A,150686,54272,C:\Users\Admin\AppData\Local\Temp\kfomwyfyun.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:3532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ScreenCapture.exe

Path C:\Program Files (x86)\XYRadish\ScreenCapture.exe
Size 242KB
SHA256 1c563ca37788b1fc72d1c3d134f7d0689c0edfc8c4a12579fe45a92385f45a3e
MD5 235b6e53b2ab785da9dac7ded3aa2739
SHA1 8e6d4ee9ed2f01b7dc45b4f032f8d78feed77307
SHA512 b72479b0d03e458ec6da815ed8f2c811ec1f0a6c60bcdae26cf0fa2e92ce964ce56eb81e7610253825fb754eadf19445af57d8ced9a8ff7eaf68b1b527701297
SSDEEP 3072:+Q3GdA5uCn2hE7Eus/pTaQwX1y6D/weNJtXt3x4d6IH:rycWE7mp+QmJpdxu6IH
TLSH
T1C4341906B4A18A71C8720B30CAE1AA797D2DEC659B316DDF4B4032247BF11F11B66DED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.exe

Path C:\Program Files (x86)\XYRadish\unins000.exe
Size 907KB
SHA256 2fbce5b4d83daee2a6ba4cbbce7eb7cecd66a2390f39f792a02d1a9585803f61
MD5 04a36dd3e9af18ce7c7cfa7e7efa0ca5
SHA1 1482b795d71d0ed4d95131c304a7396298c072e8
SHA512 19351923e2ca22e18a1798b2f6a2d072e9126c30d47c9e4fb0c1b0d42d1a3824f092fec9ea8d43a994aef4a3263226d3534c3e9ad709e138175e2d4b9cf0fa5f
SSDEEP 24576:lkHgKPNrPA37hzHIA6/oR36vln6sYEubnhRgZtnTZDExa/M:l6frPA37hzHIA6/3UvjhRgZ9TeT
TLSH
T1D2158C22F280C437C1B31E749E5786D56937BE053E28A9DB7BF91F4C4E396413A262D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfomwyfyun.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-RGO05.tmp\kfomwyfyun.tmp
Size 900KB
SHA256 e8730b0bf8f94cbb8babbfefb32cef8e8d19ec823f28c33a7d48c78589710762
MD5 f8b110dc2063d3b29502aa7042d26122
SHA1 1a0fd3db79eadc1ce714f6267d476ddbec0f5e79
SHA512 f3125d3f575aff68105ebb3eadbce30547d34e12237d8ebbc555c6fe12bcc0a5ea85a38e26f2900d70af70ec07efde3b8cd65dc0fdada637496531245ea5052f
SSDEEP 24576:dkHgKPNrPA37hzHIA6/oR36vln6sYEubnhRgZtnTZDExa/:d6frPA37hzHIA6/3UvjhRgZ9Te
TLSH
T122158C22F280C437C1B31A749E5786D5693BBE053E38A9DB7BF91F4C4E3964139262D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfomwyfyun.exe

Path C:\Users\Admin\AppData\Local\Temp\kfomwyfyun.exe
Size 446KB
SHA256 7ae568a3f72711d951aaa97c5b7e4dd1494be3cacda512f8226740000db1c679
MD5 84e9fe774a5f14512c5b23ac3fd41304
SHA1 a503ab93af16de8be4f303ae145ada68ea9a7843
SHA512 04b85fa32434dbf4d09b04a148fd2cb0fdffcafe1b5304d89f7a4b549a09f55779908de2c9895a8a3ed0bfb79fbf7ffe932bdee389e3ba6a5c7bf4bb345271b5
SSDEEP 12288:7ybwH1r9DQv2DwUwfpdvNLo61fFBy91OU:7y8HV9DQQRwrho61/u
TLSH
T1BDA41217F6E15479E162CAB02C65C0098937BD312D70B52A36FE5E6D8F372A2D90E387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1392-8-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/1392-9-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1392-50-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2420-0-0x0000000000130000-0x00000000003C9000-memory.dmp

Download

memory/2420-1-0x0000000010000000-0x0000000010284000-memory.dmp

Download

memory/3532-16-0x0000000000400000-0x00000000004F4000-memory.dmp

Download

memory/3532-17-0x0000000000400000-0x00000000004F4000-memory.dmp

Download

memory/3532-49-0x0000000000400000-0x00000000004F4000-memory.dmp

Download