5904981b80535d4159d72e1cd6feec42e02ff75cb586266b0027daabc4fab788

Resubmissions

15/05/2026, 21:25

260515-z9ndmags518

15/05/2026, 21:08

260515-zy2f4sa19j8

Analysis

max time kernel
298s
max time network
259s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/05/2026, 21:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
enter-pidor-name.exe
Size 2.2MB
Sample260515-zy2f4sa19j
SHA256 5904981b80535d4159d72e1cd6feec42e02ff75cb586266b0027daabc4fab788
MD5 b0a572141db8a09016697377e3d1d69a
SHA1 8478faf1e600cecb8df4e7b84c926817493c08aa
SHA512 50e482347a2d36a3103c6617a87aff9be2b770ff11e582574801e7991f0bf21a1f1e80a972dc22bd500db4db9f3b874ed44d054ffd03876af57d5eedc54e5e07
SSDEEP 49152:yWf/yflNLOamTF5hwbnD0t/kwtYhi30/QLOkNNtUsjQ:j/yflNSBTwus26QiMfj
TLSH
T1ABA5AE1962E301FAF1BAE17489164B13F9717459072096EFD3D80A8A6FF32E05B3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\gXIIPKvPtCCuAizwkA\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\gXIIPKvPtCCuAizwkA"	kdmapper.exe

Executes dropped EXE 1 IoCs

pid	Process
4928	kdmapper.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4928	kdmapper.exe
4928	kdmapper.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4928	kdmapper.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4928	kdmapper.exe
Token: SeLoadDriverPrivilege	4928	kdmapper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 4928	1028	enter-pidor-name.exe	80

C:\Users\Admin\AppData\Local\Temp\enter-pidor-name.exe
"C:\Users\Admin\AppData\Local\Temp\enter-pidor-name.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\RainHack_1028\kdmapper.exe
  "C:\Users\Admin\AppData\Local\Temp\RainHack_1028\kdmapper.exe" "C:\Users\Admin\AppData\Local\Temp\RainHack_1028\RainHack.sys"
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kdmapper.exe

Path C:\Users\Admin\AppData\Local\Temp\RainHack_1028\kdmapper.exe
Size 390KB
SHA256 172b8b7404222378fbbe50564c2374d4f7eddbe52e60aad352a0968b9274f7b6
MD5 5c6be8a088bea1b4000160ae519da37a
SHA1 44e183eb13e003346b36007c807d0d13d3bb4808
SHA512 923f36994edaeb9e425b1569761c7520fc2a6dc7ecff6ee2da1cf91ecf568412a9e2904d38a2e9ba8157e8eba3b9aa44a6ec0467b275e59d19b38170fa02d006
SSDEEP 6144:UOlB4Y6ozpZXVmIWUhMLbX2YBZcqMdWl36ZYDlBUdZOPa:UkB4YJpZFmouLi6cqMIV60mwa
TLSH
T11A847C56E7A404F9E1B7D178CA724902DBB1BC9A0770D6CF23A8499A1F237D44E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download