f9ecd120a4188dab36726237892714748762f8e5a1b547664b1dfbd3220abc5d

Analysis

user interaction
yes
max time kernel
298s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fishstrap.exe
Size 336KB
Sample261027-va2pras19k
SHA256 f9ecd120a4188dab36726237892714748762f8e5a1b547664b1dfbd3220abc5d
MD5 f0de52dceab4b5f3f1b96057454f378e
SHA1 8450056ae7b9906794fdc5a2c2565c7ade3bb2dd
SHA512 e8483ce0da4cfb2310f0e70357e6704349d94a1c027f903398082443d652cd99967ba729ec3f9d593e5cf79585d708980f437138e42b324d4c6d0d074c293a3e
SSDEEP 6144:OJGBU/9dsRYBccOtY0FArdAmKNLKzZuW7iHWDzKAsZnOJOfTbsw:OJQu9dsykLFAZRKFEuqiHWDmHfs
TLSH
T13B742343E280E548C1588A72C52FEB31E97DB97F079552A70F601F097D30BE8A7766D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4512	Launcher.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4512	4588	Fishstrap.exe	86

C:\Users\Admin\AppData\Local\Temp\Fishstrap.exe
"C:\Users\Admin\AppData\Local\Temp\Fishstrap.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\75840E7B\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\75840E7B\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:4512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Launcher.exe

Path C:\Users\Admin\AppData\Local\Temp\75840E7B\Launcher.exe
Size 1.1MB
SHA256 8c7237a918e53195e1cf823f93ed475fd83c06bd113663def0f2b2ca1adf873c
MD5 94cc61c4c4b74d4b2a931297746ce0a4
SHA1 8884701dafb6d5eb064b4505e149bbfe18d111e8
SHA512 2206adadbe6051475b5203aa8a183815e9da0bbd81bd0c5691c90693a42de02858b35268dc42cd26ba20d6684fb5efbc2259a6c2733317162e1dacfd40b76001
SSDEEP 12288:Sbs/m0E54jwaFXGc8lEBBBHGBKq2IZwDcvfqItNqdg:SbOVE5ifGPRZwQvf3fd
TLSH
T1D6357B83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download