Analysis
- user interaction
yes - max time kernel
71s - max time network
33s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/06/2026, 13:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
freefn (1).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
freefn (1).exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target freefn (1).exe
- Size 374KB
- Sample260624-qabfcact2t
- SHA256 c8e01c64552c752513a4169cd3f73de05c051d8624627e857d2f090d2fd98a91
- MD5 ba838a9c38f33d13a6cdf505b02513a8
- SHA1 742c7bb5f85bc62896c7e80135f75c0f4b5c05fe
- SHA512 951cffa85c67821bcd1eb3a258f09466784ceda994e5c7b2081539b6d2041eddde7c02bec30ec163c72d58d88ef879cf4f495517a28f24f3366b727413d7f662
- SSDEEP 6144:zDaQBmEkIeTmXse7ngXJMReRf+92qmLxwRxeFbEzXBsb75E/b6cx7FT+z/ExNYn4:KQnB8UwfRCRUFmX97BYn6
- TLSH T137847D81F1E451E8E0ABA07855BAF60BE535349C072059CB73EC49582FE77E07EBA391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\yjomedqFaxbHKgpZVMbUuEckhqY\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\yjomedqFaxbHKgpZVMbUuEckhqY" MAPPER.exe - Executes dropped EXE 1 IoCs
pid Process 6016 MAPPER.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 raw.githubusercontent.com 2 raw.githubusercontent.com - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4864 freefn (1).exe 4864 freefn (1).exe 6016 MAPPER.exe 6016 MAPPER.exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe 6044 freefn (1).exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 6016 MAPPER.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 6016 MAPPER.exe Token: SeLoadDriverPrivilege 6016 MAPPER.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4864 wrote to memory of 6044 4864 freefn (1).exe 89 PID 6044 wrote to memory of 6016 6044 freefn (1).exe 90 PID 6044 wrote to memory of 4480 6044 freefn (1).exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\freefn (1).exe"C:\Users\Admin\AppData\Local\Temp\freefn (1).exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\freefn (1).exe"C:\Users\Admin\AppData\Local\Temp\freefn (1).exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\MAPPER.exe"C:\Users\Admin\AppData\Local\Temp\MAPPER.exe" "C:\Users\Admin\AppData\Local\Temp\pRremium.sys"3⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:6016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:4480
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MAPPER.exe
- Size 148KB
- SHA256 43d5e60b3fd1ce90833d1249eee04622500fcad75e4b0797d2251c9956270fad
- MD5 a397e1d1010b9c961eb1b8d24b0b6827
- SHA1 cba8400e75f28204ec11303be4b6ab6fc64c775d
- SHA512 2c3aa1a6ab66fb33de144fc4b9a6bf1b576df6768f58e050bba5484c4d31723ecf5a34f2765f6b58dad91250eab489fdcd74ce51d2b2bc3ecdaa0c8df5e8ee21
- SSDEEP 3072:GpbYyEgI5/2TGsSzlHMAqxKFkwf+mJTQSaMm5/6psIJ:GVnTGsSzUaWlWsY
- TLSH T140E31A5787A4106DE2B7D6B8DA720911EB727C850B74E6CF135048BE0F62BD4BA3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH