d8809594785d9d33d0cb7399610f08dcc4bdfd379ad3a37991bc7f2c363fc4dc

Analysis

user interaction
yes
max time kernel
44s
max time network
7s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/06/2026, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
color.exe
Size 13.8MB
Sample260620-cjpsfacy2l
SHA256 d8809594785d9d33d0cb7399610f08dcc4bdfd379ad3a37991bc7f2c363fc4dc
MD5 22bdfa48658b5839a920fa2c84cf64d6
SHA1 81236a576717922e7f8ded0b71607fa622953319
SHA512 6a55e90db9aa5c599430ded7e891e549b2f93f594f5a6c80b9fcf5ea1950be95222ea045e64d2cd542056d0325781af8786c44452a642736a5edeee6782b339c
SSDEEP 196608:KeZsAulLV3fphUiuLIIHiLTKmn4bhFn50leFu1TnmHwXUZbD+DDvbq2YQ8F2lDrN:ytxRhUtLgemi3HWkeEQgcGM
TLSH
T16AE623EA50D431D4C4D78B34639F57CE61F1F5668C60A62937CB2C03EE31EAB9249A63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
1	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1732	color.exe
1732	color.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1732	color.exe
1732	color.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 4756	1732	color.exe	81
PID 4756 wrote to memory of 3632	4756	cmd.exe	82
PID 4756 wrote to memory of 3500	4756	cmd.exe	83
PID 4756 wrote to memory of 3012	4756	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\color.exe
"C:\Users\Admin\AppData\Local\Temp\color.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\color.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\color.exe" MD5
    3⤵
    PID:3632
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3500
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-0-0x000000014015E000-0x000000014096A000-memory.dmp

Download

memory/1732-2-0x00007FFA0D8E0000-0x00007FFA0D8E2000-memory.dmp

Download

memory/1732-1-0x00007FFA0D8D0000-0x00007FFA0D8D2000-memory.dmp

Download

memory/1732-4-0x0000000140000000-0x0000000141733000-memory.dmp

Download

memory/1732-7-0x0000000140000000-0x0000000141733000-memory.dmp

Download

memory/1732-8-0x0000000140000000-0x0000000141733000-memory.dmp

Download

memory/1732-18-0x000000014015E000-0x000000014096A000-memory.dmp

Download

memory/1732-19-0x0000000140000000-0x0000000141733000-memory.dmp

Download