a4c108593ab8024e93ca403f0aeb2df040633fe02e2896649dd7506570323492

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7601.17514.101119-1850_x64fre_clientn_it-it_OEM_UltimateN-GSP1RMCNULXFREO_IT_DVD.iso.cmd
Size 4KB
Sample260705-wcdldaew2v
SHA256 a4c108593ab8024e93ca403f0aeb2df040633fe02e2896649dd7506570323492
MD5 449801da40a0892b106ff9caec2328f7
SHA1 809d8548045329343da1bc206ac050862c1c01b6
SHA512 05330f57c9369be86478e2e7adf62568ddc00f544c5e8b4339d017b83e08f791fd012d01050a6bafc7f6c4ffd21229f07691d3f2b37da1420f74e13e7de34bdf
SSDEEP 48:z/sWGRfw0UymveTbIJOepqY0y1Wg7rwekEny3fRvbuLL8Ui:z7UfHuOl3Y06Xwe/yvluLIUi
TLSH
T173A1629BFD14E12122D5D767EED4A141FA46C0A770105EA4708F10BAE71FAD0EADE7C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion dropper

Malware Config

Signatures

Download via BitsAdmin 1 TTPs 2 IoCs

dropper

BITS Jobs

T1197

pid	Process
4676	bitsadmin.exe
6780	bitsadmin.exe

Executes dropped EXE 1 IoCs

pid	Process
2444	aria2c.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5040	timeout.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 6012 wrote to memory of 2628	6012	cmd.exe	90
PID 2628 wrote to memory of 4676	2628	cmd.exe	91
PID 2628 wrote to memory of 6088	2628	cmd.exe	92
PID 6012 wrote to memory of 6780	6012	cmd.exe	94
PID 6012 wrote to memory of 6736	6012	cmd.exe	95
PID 6012 wrote to memory of 3432	6012	cmd.exe	96
PID 6012 wrote to memory of 5040	6012	cmd.exe	97
PID 6012 wrote to memory of 2444	6012	cmd.exe	98
PID 6012 wrote to memory of 6504	6012	cmd.exe	99
PID 6012 wrote to memory of 6696	6012	cmd.exe	100
PID 6012 wrote to memory of 4884	6012	cmd.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7601.17514.101119-1850_x64fre_clientn_it-it_OEM_UltimateN-GSP1RMCNULXFREO_IT_DVD.iso.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:6012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bitsadmin.exe /CREATE /DOWNLOAD "Download Tools" | findstr "Created job"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\system32\bitsadmin.exe
    bitsadmin.exe /CREATE /DOWNLOAD "Download Tools"
    3⤵
    - Download via BitsAdmin
    PID:4676
- - C:\Windows\system32\findstr.exe
    findstr "Created job"
    3⤵
    PID:6088
- C:\Windows\system32\bitsadmin.exe
  bitsadmin /transfer {737356AF-8C11-40FE-B608-BEA3F2C2505B} /download /priority foreground https://files.rg-adguard.net/tools "C:\Users\Admin\AppData\Local\Temp\tools.cab"
  2⤵
  - Download via BitsAdmin
  PID:6780
- C:\Windows\system32\expand.exe
  expand "tools.cab" -f:* .\
  2⤵
  - Drops file in Windows directory
  PID:6736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:3432
- C:\Windows\system32\timeout.exe
  timeout /t 10 /NOBREAK
  2⤵
  - Delays execution with timeout.exe
  PID:5040
- C:\Users\Admin\AppData\Local\Temp\bin\aria2c.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\aria2c.exe" -x1 -s1 -d"C:\Users\Admin\AppData\Local\Temp\23293" -o"list.txt" "https://files.rg-adguard.net/file/50395bcd-ff9b-4c91-14d8-67104053aadf/list" --disable-ipv6
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type "C:\Users\Admin\AppData\Local\Temp\23293\list.txt"
  2⤵
  PID:6504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type "C:\Users\Admin\AppData\Local\Temp\23293\list.txt"
  2⤵
  PID:6696
- C:\Windows\system32\choice.exe
  CHOICE /c fs /n /m "Save all or just the requested file?"
  2⤵
  PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

list.txt

Path C:\Users\Admin\AppData\Local\Temp\23293\list.txt
Size 423B
SHA256 6a91be56cea194cfb707f6e8c484b6cb2b65288d7c6203666506d4c97a4d4c79
MD5 4573bcfe9823592c2d8ab9e7f9fd477f
SHA1 c633f453ddbd2cac49ede5838554b905ae820c68
SHA512 fd709503868f333d47235217fed8d98ec8ad274b9df4438dd132cc08dd33190f4f6968b0ee34e226cb5fbbc39cb93158387d7e874a11e7258e824152d7234931
TLSH
T178E0AB88132185FF2D7C70F9FD26B8983FB68AB00093365347B3AA8A1133B01CC9519A
MD5 SHA1 SHA512 TLSH

Submit Download

aria2c.exe

Path C:\Users\Admin\AppData\Local\Temp\bin\aria2c.exe
Size 5.4MB
SHA256 be2099c214f63a3cb4954b09a0becd6e2e34660b886d4c898d260febfe9d70c2
MD5 8c71b86bf407c05baf11e8d296b9c8b8
SHA1 6624ab8ca883c48f02c58250d4eee9e90098f4e4
SHA512 bb3fee727e40f8213f0a7d9808048e341295a684ecba6f4df52f1b07b528d7206ca41926b2433f4b63451565ad2854570fee976bc7051b629acd24fca6d0f507
SSDEEP 98304:jgRfP5jnFTyGZEWxSIBHVGT+t1ufqchZ:kRZDFTyGaHIJoWofqc
TLSH
T1F0463917E2A310ECC26BC170476BA273B932F81915307E7F79A8DB751F21E605A6DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2444-26-0x00007FF702610000-0x00007FF702B7D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads