4dd69d0e77c00a8897f2e9c65f2be43fe761ef928a9047281fbd32dde91b22ee

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 15:42

Target
CS Demo.exe
Size 136KB
Sample260528-s5txaaex91
SHA256 4dd69d0e77c00a8897f2e9c65f2be43fe761ef928a9047281fbd32dde91b22ee
MD5 76c59031677474c10fefb5abe881dc1b
SHA1 b99a7096222e9966f9f52b0cb6d0b6280f99352b
SHA512 283f202e9404a0ba32b2336afe8f4adc3756f0d42135670a8167669972d2e675de44255362078f0b9e91218c72eb691c5920905a39b081c7da5415a9ecf2a680
SSDEEP 3072:b454jE83DwHBoi2r7Z9V58lmpCnclxuZmPYBZV:b454jECi2rd9V58Mp/xuZmwB
TLSH
T1D1D32947B2A800FDD1BBA37889A21A05F777B819477297CF0390857A1F67BD09E7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Downloads MZ/PE file 2 IoCs

flow	pid	Process
28	3996	CS Demo.exe
76	3996	CS Demo.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

C:\Users\Admin\AppData\Local\Temp\CS Demo.exe
"C:\Users\Admin\AppData\Local\Temp\CS Demo.exe"
1⤵
- Downloads MZ/PE file
PID:3996

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact