Overview

overview

7

Static

static

3

CDXTOOLV4.7.exe

windows10-2004-x64

7

CDXTOOLV4.7.exe

windows11-21h2-x64

7

Resubmissions

01/07/2026, 16:44

260701-t9bryaav7m8

25/04/2026, 00:30

260425-atlsesh13y7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    25/04/2026, 00:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CDXTOOLV4.7.exe
  • Size 16.2MB
  • Sample260425-atlsesh13y
  • SHA256 efa419bce735279690fb8bd8f577c467cedd6b266360789d5b2c13549f2558fb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 30 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CDXTOOLV4.7.exe
    "C:\Users\Admin\AppData\Local\Temp\CDXTOOLV4.7.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2784
    • C:\Users\Admin\AppData\Local\Temp\CDXTOOLV4.7.exe
      C:\Users\Admin\AppData\Local\Temp\CDXTOOLV4.7.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2224
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c mode con: cols=100 lines=30
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2052
        • C:\Windows\system32\mode.com
          mode con: cols=100 lines=30
          4⤵
            PID:4748
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cls
          3⤵
            PID:3580
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c
            3⤵
              PID:2936

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              _asyncio.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_asyncio.pyd
              • Size 72KB
              • SHA256 bac2870d61a72be50cabc968be924147132036185b3b538aa3b1b43d8c828a2e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _bz2.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
              • Size 84KB
              • SHA256 178c6eeb30843e656cc407aaf53ae6d0f170966e4e0bdd2ee1bede73962275cd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ctypes.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
              • Size 124KB
              • SHA256 9ffdedd0f1f09f21870bd75c08d05c32994a1193be3955e367f260690a36cbd0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _hashlib.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pyd
              • Size 65KB
              • SHA256 823717926adce6b36f9c13b6555eaeaf5714c4756828f11cffc1ce0bef970a7e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _queue.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_queue.pyd
              • Size 32KB
              • SHA256 37622ca591fb8e45a894db9c0da99bfcb18a820a48f028e4949d9256b69247e3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _uuid.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_uuid.pyd
              • Size 27KB
              • SHA256 20557961ac93ae00829b0865018bcc565e41b52b103d2aa58405a0208ada148f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _http_parser.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_http_parser.pyd
              • Size 243KB
              • SHA256 7bf6dac44511ebf7ad91d0d4f3b5655250bd03653a641bb1833ee1feddd326eb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _http_writer.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_http_writer.pyd
              • Size 46KB
              • SHA256 81031dbc40a6d3741720a0676de7bd3986ef8000c479f4267a19ddfdfb44bedf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cacert.pem
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem
              • Size 284KB
              • SHA256 2089fc5a25836401faee99f722460b01b393999746a0fb817943666d6ecc0458
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              md.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md.pyd
              • Size 10KB
              • SHA256 76a535e0953b48a2348b877236a5799cf1d01cb21422c7f17942f35367cb5c8f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libcrypto-3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-3.dll
              • Size 5.0MB
              • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _multidict.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\multidict\_multidict.pyd
              • Size 79KB
              • SHA256 68857f6684df6ebc29a4eeae96ba93e9a205d283877426a364c1e0b99ae830c0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              select.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd
              • Size 32KB
              • SHA256 fcac4646ff709ac07aee532c4612a19b7070f2dd6ef67ba09c743644e92f7376
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              unicodedata.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd
              • Size 1.1MB
              • SHA256 e7fe7ae7342b1dec8dfe52a95d768039a46189209b9f42a21c4d2473faaa1753
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Legit3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\Legit3.dll
              • Size 37.5MB
              • SHA256 ecf42614a91ce74c36c85e4618d089933ab910fbe18050f92681f8d587b013a8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _lzma.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\_lzma.pyd
              • Size 156KB
              • SHA256 f6e0c786395ccc7b22f4c435b19f7073eb5974eb29e09f4c91060cab10450e6a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _overlapped.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\_overlapped.pyd
              • Size 55KB
              • SHA256 0e6081da5bbf8fcd756b02153ab7fca12bd0bc04842abe5765f7409af4987b17
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _socket.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\_socket.pyd
              • Size 83KB
              • SHA256 0e2c1089974a2757426dac3295201a33c990c36f3c09593f8a2b6e07fd36b99c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ssl.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\_ssl.pyd
              • Size 175KB
              • SHA256 81344e3e16cf6f2d5b24cc0cf92e95c5fd0592e4a3859bb00c3f5891e2482128
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _wmi.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\_wmi.pyd
              • Size 39KB
              • SHA256 af1077d6377d5a0aea123f0c324cc6d151ac4a29a84aae23a6936b6d1c64b70a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              mask.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\aiohttp\_websocket\mask.pyd
              • Size 36KB
              • SHA256 ff30dd6df228423897bda852aa70e0022d3bbcdde6b679e42750d9b11c1a2265
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              reader_c.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\aiohttp\_websocket\reader_c.pyd
              • Size 144KB
              • SHA256 66e600eccf0e236199aa6e4ee2d27600c146664996f0c9c469b1ee9e3afdb335
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              md__mypyc.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\charset_normalizer\md__mypyc.pyd
              • Size 124KB
              • SHA256 0830c3ff6e6f8394a7df170f95fc10de65ab9f22b30f9d2383f0cc299b8df101
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _frozenlist.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\frozenlist\_frozenlist.pyd
              • Size 68KB
              • SHA256 ac03ce4d67b103af56efa5a436954c6c5e4da0eafec878a31298f2b8ce9c6f96
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libffi-8.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\libffi-8.dll
              • Size 38KB
              • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libssl-3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\libssl-3.dll
              • Size 774KB
              • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _helpers_c.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\propcache\_helpers_c.pyd
              • Size 63KB
              • SHA256 f40a9706e20058cda899118faa7a68ee584302a4fd6933bab87ed0bc5ce7d2ca
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python312.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\python312.dll
              • Size 6.6MB
              • SHA256 3b56fa10d3797c231468cee42caeaaaff40dbede7bc0d142ec4878493f48e07d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcruntime140_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\vcruntime140_1.dll
              • Size 48KB
              • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _quoting_c.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\yarl\_quoting_c.pyd
              • Size 85KB
              • SHA256 1dbf18a57fa7ea865700141b6bf3ca7656d136b7cb5b0134c2da7744b4b4c653
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              backend_c.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_2784_134215506833641710\zstandard\backend_c.pyd
              • Size 513KB
              • SHA256 2ce792041f2bf7d8a8f514f0fb5adfc7778e56e988491e6ac7f3438c2e8cb3d3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/2224-101-0x000001AAB9E60000-0x000001AAB9F0E000-memory.dmp
              Download

              memory/4748-99-0x000002349DD00000-0x000002349DDAE000-memory.dmp
              Download