Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/05/2026, 15:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CS Demo.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
CS Demo.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
CS Demo.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
CS Demo.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
wearedevs_exploit_api.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
wearedevs_exploit_api.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target CS Demo.exe
- Size 136KB
- Sample260528-s5txaaex91
- SHA256 4dd69d0e77c00a8897f2e9c65f2be43fe761ef928a9047281fbd32dde91b22ee
- MD5 76c59031677474c10fefb5abe881dc1b
- SHA1 b99a7096222e9966f9f52b0cb6d0b6280f99352b
- SHA512 283f202e9404a0ba32b2336afe8f4adc3756f0d42135670a8167669972d2e675de44255362078f0b9e91218c72eb691c5920905a39b081c7da5415a9ecf2a680
- SSDEEP 3072:b454jE83DwHBoi2r7Z9V58lmpCnclxuZmPYBZV:b454jECi2rd9V58Mp/xuZmwB
- TLSH T1D1D32947B2A800FDD1BBA37889A21A05F777B819477297CF0390857A1F67BD09E7A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 5 IoCs
flow pid Process 4 2512 CS Demo.exe 6 2512 CS Demo.exe 8 2512 CS Demo.exe 10 2512 CS Demo.exe 12 2512 CS Demo.exe - Loads dropped DLL 3 IoCs
pid Process 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe - Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 12 raw.githubusercontent.com 1 raw.githubusercontent.com 4 raw.githubusercontent.com 6 raw.githubusercontent.com 8 raw.githubusercontent.com 10 raw.githubusercontent.com - Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral4/files/0x001a00000002b68e-15.dat embeds_openssl - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe 2512 CS Demo.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\XENO_CACHE.bin
- Size 28B
- SHA256 895c607361d12436b3c82f8e233278f594d1de2ac032fd9534670a26f9bd5ce5
- MD5 78d58a032761f1b9767ce9a961560a55
- SHA1 16e75b82eb992b85361cfa782e2eac73f627717e
- SHA512 4395ec8d0e057016daa654d94aeac4aea172814193ee9c3d5717093636db0972fea522a5e0596427b7c89cc2ab7f10c9be7c103b12b0c4151fc7b221d13e0f0e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Documents\jjsploit\WRD.dll
- Size 2.2MB
- SHA256 66e360db5a157a4beed3aaf46a70fa81c2881d14618a8f2569f156d94c4e9131
- MD5 6a18d34551f611fd95b17f358e836e5a
- SHA1 e7c8f42b5b2355ac3f927f39bb98378a19d11a29
- SHA512 800065f8896503fd9b21635a21c2eb174330fb58c72ad6953b8c630422d1966fd1dffae84f93cb9e85bf938b6d4dfba1452d3fc468cfac686da6497a6432f790
- SSDEEP 24576:hbHIRtNszsfRvGJuJzcgwZYLb/ly/cF5YUYtGIJhHh/6MRs3MLduC5OLxpzgbTx5:hSW0OJKyZYLb/ly/c74r/fiAfLdPh3r
- TLSH T1F2B59F16B15900E8C167D1F8CA5B8603FBB27C550324A7FB12F0A6652F17BE29EBE711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\jjsploit\libcrypto-3-x64.dll
- Size 4.5MB
- SHA256 03ec9292dcdfda520638490e11baeefff5ab1b6eb22feb90a22fc771272ce116
- MD5 a9c1f7ca15c65c139bc9d4bf57df2e1e
- SHA1 1b1377139a6b289d43a6b1161cd1089ffc817cf9
- SHA512 97f8745dba6330c196de9b822638bfe7f74a86bdcb6726f4bd1d3d917de54f9abcb05163c42255173eac3bde995f0d611af718dbcc0de432b67666bed0c0b073
- SSDEEP 98304:Ml+f+K26t8Te5zUeP4xA1CPwDvt3uFGCCQ:4Ctt8Te5zUewxA1CPwDvt3uFGCC
- TLSH T112269DA9A5BC0056E86A91BCC3876227D371B51657F057CF2E688AF90F23FD1227B740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\jjsploit\libssl-3-x64.dll
- Size 802KB
- SHA256 0bda7daeb4040c722b8c287dfd2307c9b8228576db1dbbbaac901c35cc8dc62b
- MD5 51b0d5f42a82f6fa8739b403e9b8b81c
- SHA1 75968c157628bb7aca9b5f2331f7a0c9a1d28865
- SHA512 94fba90ad7bcf190079089dcc3af97c598c016eb359fe4d2ea439b5fbcd4a5489ab4422652223926aae64002beef1368d5b95874f68a2e5bc4971b4f9604d814
- SSDEEP 12288:Mzjte0Fevo3VS1npHEDHLqjRmqWSTzt7opiTdEVB3S:M9e5o3VVZVSPtopwdEVB3S
- TLSH T189053B69BBB8059CD876C13986934213E6F6B4563370EBDB0B648A790F23BD4273E344
- MD5 SHA1 SHA512 SSDEEP TLSH