c8bac90c3ee6265fd847eefc4c4c5174c0fa9b690c92a3a2c1b39b63d5a79591

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dart_flutter_demo.exe
Size 181KB
Sample261113-jp5jeahv7r
SHA256 c8bac90c3ee6265fd847eefc4c4c5174c0fa9b690c92a3a2c1b39b63d5a79591
MD5 58b49629234097cc72b109a50896d5a7
SHA1 51aed1438b248f9db030cb8a4852b2071bc0f65c
SHA512 8cb732269557fc89db0a1a0b1e2e10d64c2ed87c1ca16459bf3d0607ae238b477bd5f83193fd5cb48d6addeb7e4f7cf8b604f5b712bfeefcc3b94cf508428552
SSDEEP 3072:ES1ZlCciRg7q9J7Djbb+K0leIviNEn7Qca97C9PG3G+0WvYNhrUTARdoegcEIH:EwZ5iRt9J7DjbGl7oAu3G+4gKdoXt
TLSH
T11204D156EB2940EBE3598DB8CD434906CA23FC8B87E1A6CB97801DD70E66ED44F3D611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	dart_flutter_demo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dart_flutter_demo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dart_flutter_demo.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dart_flutter_demo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dart_flutter_demo.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dart_flutter_demo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	dart_flutter_demo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	dart_flutter_demo.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5768	dart_flutter_demo.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5768	dart_flutter_demo.exe

C:\Users\Admin\AppData\Local\Temp\dart_flutter_demo.exe
"C:\Users\Admin\AppData\Local\Temp\dart_flutter_demo.exe"
1⤵
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dart_flutter_demo_system_info_20261113_075209.log

Path C:\Users\Admin\AppData\Roaming\io.github.vincentzyuapps\DartFlutterDemo\DartFlutterDemo\logs\dart_flutter_demo_system_info_20261113_075209.log
Size 601B
SHA256 ddb915f414ffe4730bbb2cc7086af0fee59d417f8970d880c5871b79ff8b7c8c
MD5 a9f1a99869e03b2b0ccf7fcd888607db
SHA1 a780122c21e477640892133d559430fae5675a96
SHA512 152808b2733d47f5db6ec2866cf6642c68dcc197b411f15c02728d50356c91f475ae8a9980f51b1d10358c29953f2fbe9b8a639928d38da87d684671b857a5aa
TLSH
T137F0AC65B69080A2415CC2C2857F73259A2B117D714C0CDD7BCAC64CFC19E2B8F786BB
MD5 SHA1 SHA512 TLSH

Submit Download

dart_flutter_demo_system_info_20261113_075209.log

Path C:\Users\Admin\AppData\Roaming\io.github.vincentzyuapps\DartFlutterDemo\DartFlutterDemo\logs\dart_flutter_demo_system_info_20261113_075209.log
Size 1KB
SHA256 80ccbd2fcc3e099daedbb8352741b1b0a49f2952705e2ea41353377bf57bb4a5
MD5 d4306bca4e97b0fc2a0ec292c2b26ff5
SHA1 7ba6975f8b6352b9439f1b0153093e20358f7fbb
SHA512 d9e036f5b22ca6fa873a33d06285330182d0d439def60b999e91026e427575c7734e70d390de5f3a3154748008cefe0df8068f4725fc47161b505dd65bf85c48
TLSH
T1F1218B1675C0907146AA828280BF37A5EB1B6379B51C18ED7F8BC28D7C54D1BAD142AB
MD5 SHA1 SHA512 TLSH

Submit Download

dart_flutter_demo_system_info_20261113_075209.log

Path C:\Users\Admin\AppData\Roaming\io.github.vincentzyuapps\DartFlutterDemo\DartFlutterDemo\logs\dart_flutter_demo_system_info_20261113_075209.log
Size 2KB
SHA256 3bf050fd302557092da76f9db52456528c4b785d864d14ef3a31fe6f05766998
MD5 c57f4c575359d8fdda88e6fa0b9d8a8b
SHA1 f04bac62fc80725ea75c27ae55fd9315cef78469
SHA512 a7522b506a1be6bbbed1c5fd088a00f4f1d9a19bea895e050b55289e4df9c27d718d83615baacbf3e06011efbe03008ce52f28268bc97a9bad7b986d85e189b8
TLSH
T17141AF0670D0A07187A6518180BF7BE6FB1BA3B6A40C18DD7FCB82DE7C1991F5D5429B
MD5 SHA1 SHA512 TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads