23ef62989c2210f05bd598c64ec995b96c381ee15ff78ecdd6225fb163c0a388

Analysis

user interaction
yes
max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WeModPatcher.exe
Size 2.0MB
Sample260705-ftstmadv7j
SHA256 23ef62989c2210f05bd598c64ec995b96c381ee15ff78ecdd6225fb163c0a388
MD5 2d2b9c759730a8b30107748a3fdf9f09
SHA1 229b793724849ebc236d1352d8abae6c825fe256
SHA512 70fe8eae71249364eb8d406514568bb179b18333da210ed713a7587e7371882b3ae7c2c658065a9dcc76e40eb79d261dba542bbd96967f69893972b1a6cb8a46
SSDEEP 49152:pdTE5z0C1/bruDDlz7+L/HjBPr8u+3m+tC/1Y9:G0C1IW/H5kE/1Y9
TLSH
T1019501A3A7949F68FED040FAC421CD5E95B1EF21722B527B03F476B6394AE418B27071
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
4176	tasklist.exe
6052	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4792	powershell.exe
1180	powershell.exe
4576	powershell.exe
5440	powershell.exe
5364	powershell.exe
1292	powershell.exe
2184	powershell.exe
1876	powershell.exe
4716	powershell.exe
6080	powershell.exe
5528	powershell.exe
1728	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
5528	powershell.exe
5528	powershell.exe
5440	powershell.exe
5440	powershell.exe
5364	powershell.exe
5364	powershell.exe
5364	powershell.exe
5364	powershell.exe
5364	powershell.exe
1728	powershell.exe
1728	powershell.exe
4792	powershell.exe
4792	powershell.exe
1180	powershell.exe
1180	powershell.exe
1292	powershell.exe
1292	powershell.exe
2184	powershell.exe
2184	powershell.exe
1876	powershell.exe
1876	powershell.exe
4716	powershell.exe
4716	powershell.exe
6080	powershell.exe
6080	powershell.exe
4576	powershell.exe
4576	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	5528	powershell.exe
Token: SeDebugPrivilege	5440	powershell.exe
Token: SeDebugPrivilege	4176	tasklist.exe
Token: SeDebugPrivilege	5364	powershell.exe
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeDebugPrivilege	6052	tasklist.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	6080	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 5148 wrote to memory of 1676	5148	WeModPatcher.exe	89
PID 1676 wrote to memory of 964	1676	cmd.exe	90
PID 964 wrote to memory of 5932	964	cmd.exe	91
PID 1676 wrote to memory of 5144	1676	cmd.exe	93
PID 5144 wrote to memory of 5528	5144	cmd.exe	94
PID 1676 wrote to memory of 2320	1676	cmd.exe	95
PID 2320 wrote to memory of 2860	2320	net.exe	96
PID 1676 wrote to memory of 5440	1676	cmd.exe	97
PID 1676 wrote to memory of 2724	1676	cmd.exe	98
PID 2724 wrote to memory of 4176	2724	cmd.exe	99
PID 1676 wrote to memory of 2864	1676	cmd.exe	101
PID 2864 wrote to memory of 5364	2864	cmd.exe	102
PID 1676 wrote to memory of 3052	1676	cmd.exe	103
PID 3052 wrote to memory of 572	3052	cmd.exe	104
PID 1676 wrote to memory of 2292	1676	cmd.exe	105
PID 1676 wrote to memory of 3968	1676	cmd.exe	106
PID 1676 wrote to memory of 5272	1676	cmd.exe	107
PID 5272 wrote to memory of 1728	5272	cmd.exe	108
PID 1676 wrote to memory of 4764	1676	cmd.exe	109
PID 4764 wrote to memory of 4792	4764	cmd.exe	110
PID 1676 wrote to memory of 1180	1676	cmd.exe	111
PID 1676 wrote to memory of 5456	1676	cmd.exe	112
PID 5456 wrote to memory of 6052	5456	cmd.exe	113
PID 1676 wrote to memory of 1292	1676	cmd.exe	114
PID 1676 wrote to memory of 2880	1676	cmd.exe	115
PID 2880 wrote to memory of 2184	2880	cmd.exe	116
PID 1676 wrote to memory of 1876	1676	cmd.exe	117
PID 1676 wrote to memory of 1356	1676	cmd.exe	118
PID 1356 wrote to memory of 4716	1356	cmd.exe	119
PID 1676 wrote to memory of 5496	1676	cmd.exe	120
PID 5496 wrote to memory of 5424	5496	cmd.exe	121
PID 1676 wrote to memory of 1840	1676	cmd.exe	122
PID 1840 wrote to memory of 6080	1840	cmd.exe	123
PID 1676 wrote to memory of 4420	1676	cmd.exe	124
PID 4420 wrote to memory of 4576	4420	cmd.exe	125
PID 1676 wrote to memory of 2384	1676	cmd.exe	126
PID 1676 wrote to memory of 2800	1676	cmd.exe	127
PID 1676 wrote to memory of 5996	1676	cmd.exe	128
PID 5996 wrote to memory of 976	5996	cmd.exe	129

C:\Users\Admin\AppData\Local\Temp\WeModPatcher.exe
"C:\Users\Admin\AppData\Local\Temp\WeModPatcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5148
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\E181.tmp\E182.tmp\E183.bat C:\Users\Admin\AppData\Local\Temp\WeModPatcher.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl -s https://raw.githubusercontent.com/brunolee-GIT/W3M0dP4tch32/main/W3M0dP4tch32L1nk5
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\Windows\system32\curl.exe
      curl -s https://raw.githubusercontent.com/brunolee-GIT/W3M0dP4tch32/main/W3M0dP4tch32L1nk5
      4⤵
      PID:5932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "[string]([Version]'1.2.5', [Version]'1.2.5' | measure-object -maximum).maximum"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "[string]([Version]'1.2.5', [Version]'1.2.5' | measure-object -maximum).maximum"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5528
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "[console]::title='WeModPatcher'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "WindowTitle eq "WeModPatcher""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "WindowTitle eq "WeModPatcher""
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "(Get-Process -Id 5148).ProcessName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-Process -Id 5148).ProcessName"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c chcp
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:572
- - C:\Windows\system32\chcp.com
    chcp 850
    3⤵
    PID:2292
- - C:\Windows\system32\mode.com
    mode con cols=24 lines=10
    3⤵
    PID:3968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms;([System.Windows.Forms.Screen]::AllScreens).WorkingArea.Width"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -AssemblyName System.Windows.Forms;([System.Windows.Forms.Screen]::AllScreens).WorkingArea.Width"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms;([System.Windows.Forms.Screen]::AllScreens).WorkingArea.Height"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -AssemblyName System.Windows.Forms;([System.Windows.Forms.Screen]::AllScreens).WorkingArea.Height"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "[console]::title='WeModPatcher'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "WindowTitle eq "WeModPatcher""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5456
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "WindowTitle eq "WeModPatcher""
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Write-Host -B 13 -F 13 '....' -NoNewline; Write-Host -B 5 -F 5 '....' -NoNewline; Write-Host -B 1 -F 1 '....' -NoNewline; Write-Host -B 9 -F 9 '....' -NoNewline; Write-Host -B 3 -F 3 '....' -NoNewline; Write-Host -B 11 -F 11 '...' `n`n -NoNewline; Write-Host -B 0 -F 10 ' WeModPatcher v1.2.5'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "[math]::Round((24 - '1920x1032'.length) / 2)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "[math]::Round((24 - '1920x1032'.length) / 2)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Write-Host -B 0 -F 0 ''.PadRight(8) -NoNewline; Write-Host -B 0 -F 14 '1920x1032'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "(Get-FileHash Options.ini -Algorithm MD5).Hash"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-FileHash Options.ini -Algorithm MD5).Hash"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" /V "AppsUseLightTheme"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5496
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" /V "AppsUseLightTheme"
      4⤵
      PID:5424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "(Get-Culture).DisplayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-Culture).DisplayName"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "(Get-Culture).Name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-Culture).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4576
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2384
- - C:\Windows\system32\chcp.com
    chcp 850
    3⤵
    PID:2800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mshta.exe "C:\Users\Admin\AppData\Local\Temp\Launcher.hta"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5996
  - - C:\Windows\system32\mshta.exe
      mshta.exe "C:\Users\Admin\AppData\Local\Temp\Launcher.hta"
      4⤵
      PID:976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact