a78fcd7f7d318bc47f7c29da7223a8633f76c716b401b2a21036418aa0e9c3a4

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FLiNGTrainer_setup.exe
Size 2.2MB
Sample261030-d25gaaws2q
SHA256 a78fcd7f7d318bc47f7c29da7223a8633f76c716b401b2a21036418aa0e9c3a4
MD5 7b030be20658a2c1d5bad362e7d3e801
SHA1 e3a873c7e8dc3f4a934035504707f88247992ad9
SHA512 d90462159ae3f2b38c324afe1eebc5918f34ca665a86fbfa720b3e881dfa155e82f8942b6d162d8ff85d368639dad5925d7d50310101e9e2ad2dbf6c37a9bf3c
SSDEEP 49152:hZ4e9UnebVECtTdzZKSIlS+lVV9Q0eD3VkcFKS5HJLekl1zWAOC9NG:hZ4e9wkVECjltIEuKD70SNxzWArNG
TLSH
T14BB501E63345C3C1C8A6147484EEFB68C6A06DF563E4C20AF2553EEAA9343979F8D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
3916	FLiNGTrainer_setup.exe
3916	FLiNGTrainer_setup.exe
3916	FLiNGTrainer_setup.exe
3916	FLiNGTrainer_setup.exe
3916	FLiNGTrainer_setup.exe
3916	FLiNGTrainer_setup.exe
3916	FLiNGTrainer_setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FLiNGTrainer_setup.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4180	taskkill.exe
440	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4180	taskkill.exe
Token: SeDebugPrivilege	440	taskkill.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 4180	3916	FLiNGTrainer_setup.exe	89
PID 3916 wrote to memory of 440	3916	FLiNGTrainer_setup.exe	92

C:\Users\Admin\AppData\Local\Temp\FLiNGTrainer_setup.exe
"C:\Users\Admin\AppData\Local\Temp\FLiNGTrainer_setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im FLiNGTrainerUpdater.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4180
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im FLiNGTrainer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm2225.tmp\System.dll
Size 10KB
SHA256 f9c47cf365f3607bc9abbce76839d02e6309a0d4389f1d2e0efb8d01e32459e9
MD5 b0a81b7b1bd6bbfe15e609df42791d22
SHA1 1b6f6726740b02aafdbe19cdc7b9dc5a2fdc4f75
SHA512 e105e7a3d4a908e59a8c8ab480d228bc4106e93f7fb833e6a5dea5ee0f2757c8617bda181324a059568d4b4c0b72b8628e60cf520c4f1b282305dbb34b5da194
SSDEEP 192:Tv+cJZE61KRWJQO6tFiUdK7ckD4k7l1XRBm0w+NiHi1XSJ:Tf6rtFRdbQ1W+fX8
TLSH
T1C4225C5893E0C1F3D6A0853C18573A772729712455A18FE3CFA35841AE196D7BC7E336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm2225.tmp\nsExec.dll
Size 6KB
SHA256 e0959b690f25160d590cfd7e2467bb9ce7e9d959663e7e203f502dce5246507d
MD5 2fd10d2f8ae885cc7e34ff21703aef6c
SHA1 7a1862a0240684a423c2d988557ab5b306af85e1
SHA512 fde884c9e988dd04a0e6b1e14b295e911b3d835ca92ed1a7a4c8bdc05326446092d17f75013a4ec9dc3e05cb351fd42b87d9ed96df70d0d5e4c9048f5fb5a546
SSDEEP 96:87GUeYNrwgcrEzyKwZxW4JxNABWweYkZleOe4I9d0qqyVgNY32E:uGgrwgcrEzylQBHkZwd0qJVgND
TLSH
T183D1D83D76C33DB3C54ACA753C65292F0FB8D8261B5402119B6716C279D5AE3FE29382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsInstall.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm2225.tmp\nsInstall.dll
Size 4.1MB
SHA256 2abd7e39a76d2175fb4bbab7a0cc52b617764cc8ae157b2ed154c5b6e9acfa85
MD5 8376a61068e66efac7101e16e5933752
SHA1 2b2b0e768aefb43022b32deff7111001857d49ad
SHA512 d6f67a71d44987e5f7261fe6a5a6ccabb555a3e58e482ae35bd4fb7e5a398b3af6944bb01c4717785856fc832c1decadb93bdd389377baee7075016ceb9d6bc2
SSDEEP 98304:c3vezFwsyUP5mMqwmfS3zVawdAtRasbMlEEKADU2:cezFwsbq4zVawd2sEEbU
TLSH
T17116AE12BA8282F1E98A0174516FEF7A8D395D7443A4C5D3F3D03D6589313D26B3E3AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.data

Path C:\Users\Admin\AppData\Roaming\FLiNGTrainer\log.data
Size 1KB
SHA256 e8ba2094aad0f8ce4ac86ecd4b41ee36396ce092ab3729cdca9de19a1c4e51d5
MD5 82de4bc7406df71af99a9a49c351fd00
SHA1 eb9242e4f77a171a6e3885bb126ae7d4cef5f306
SHA512 9dc583b745697749f9c99583c7367c85b889775fadd69d5a65fb3469a6c84060f32ef65a0618dc1e1bfeaf22f38720e012dbb9cd167e1636c68cd2177b59c99d
TLSH
T10431809F66FF1E76C20EBC53319F17C5291B913F019DE450612461F942E284DB3BE2A2
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads