3544dd04c949ca603e4ae57364796eb9286801e9e4c4712e8bd98ba8d2666d5f

Analysis

max time kernel
32s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ShulkerV2.exe
Size 14.8MB
Sample261113-e2agkszx3m
SHA256 3544dd04c949ca603e4ae57364796eb9286801e9e4c4712e8bd98ba8d2666d5f
MD5 36bfbab4cdb7479161a8d828e4813a0c
SHA1 71c395e8f21a8cb2a838ff545aa2f55f5281a1d6
SHA512 2256b8289c4804e0b4a97d5ad62864593a6f15cf056fbe333bea6eb90bda0a4e54aaaaa742633bfdec88b83ceaf8aa883e7b40ae366d489ed590a2974bfb4f1c
SSDEEP 393216:u+/Tj2liKjFhe6LfKRQuqHI7sAdX+Ot9:u8jfKBsAHK11
TLSH
T1C5F63388DC94AC42F0C2DEFE542DE298AAE73E54B6C112D3D6D1679FC62F5478108BB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3424	ShulkerV2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ShulkerV2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ShulkerV2.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 3424	1912	ShulkerV2.exe	86

C:\Users\Admin\AppData\Local\Temp\ShulkerV2.exe
"C:\Users\Admin\AppData\Local\Temp\ShulkerV2.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\Local\Temp\6BAEFD7B\ShulkerV2.exe
  "C:\Users\Admin\AppData\Local\Temp\6BAEFD7B\ShulkerV2.exe"
  2⤵
  - Executes dropped EXE
  PID:3424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ShulkerV2.exe

Path C:\Users\Admin\AppData\Local\Temp\6BAEFD7B\ShulkerV2.exe
Size 43.7MB
SHA256 c3a09d6a9476ec1fe1bdc4e79cb8c64a23e95c9e6814b80b94756313172f8dd2
MD5 d5d917865fc5dd47abbbfba450f48e4b
SHA1 f9d7e0ba32607e9046fe086ebe3fb4fd102ec2d5
SHA512 aff99263fc6e2c935dc607ea45fe94483e88775026a19f395b09a6a7c034688556bfa8403cdc986a321d8e27f15929e5cfce674bd85c53a50ea1a658ee20b8d3
SSDEEP 196608:gqlMfKLB4ix7sMe1UNVxl7RCE1vpox2Awtp7UI7Sg1LFHgDUIBBsLRb0CPw:gGvqah3XNtUI7rLiZCP
TLSH
T111A73B2FB96448D4E0BEC936C922961B7FB13C55472027D32A68FA182F7DBE015FA354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1912-0-0x00000288F38D0000-0x00000288F39EC000-memory.dmp

Download