Analysis
- user interaction
yes - max time kernel
150s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 18:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
atlasfreefn.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
atlasfreefn.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target atlasfreefn.exe
- Size 386KB
- Sample260716-xe4e9afv9x
- SHA256 27ee58565da7d35204e0939dc3034c5e2d6cf81d6d8df5dc2487ab35fed92aa9
- MD5 1e13161271c47d6202ec9a180655a1cc
- SHA1 45e0436c033cc2f39aa2bf4b106b035872d11a99
- SHA512 b066bf226bfced2a34aaa9936429357e1474e363af36394c114ad81d964ba544c0365f9750d49b09c873972e47eabc509cf851280fb5117cd296e7b32c80bcbb
- SSDEEP 6144:9fIhYQAeEE/Wwz+h9urdvvg+ImtH+X9jZPdQZfSaAhnhMOj6MknsPd+bnj:yYQgEg+EtgZNCknsl+bj
- TLSH T1A9848E86F1A490E5D0AFA078916BB30BE975384D07505ACB73E84D943BE37E07BBA741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EUZQwqKbZnglFdIjiddgbfcVQZ\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EUZQwqKbZnglFdIjiddgbfcVQZ" kdmapper_Release.exe - Executes dropped EXE 1 IoCs
pid Process 5712 kdmapper_Release.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 2 raw.githubusercontent.com 4 raw.githubusercontent.com - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5268 atlasfreefn.exe 5268 atlasfreefn.exe 5712 kdmapper_Release.exe 5712 kdmapper_Release.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe 1604 atlasfreefn.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 5712 kdmapper_Release.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5712 kdmapper_Release.exe Token: SeLoadDriverPrivilege 5712 kdmapper_Release.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5268 wrote to memory of 1604 5268 atlasfreefn.exe 89 PID 1604 wrote to memory of 5712 1604 atlasfreefn.exe 91 PID 1604 wrote to memory of 236 1604 atlasfreefn.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\atlasfreefn.exe"C:\Users\Admin\AppData\Local\Temp\atlasfreefn.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\atlasfreefn.exe"C:\Users\Admin\AppData\Local\Temp\atlasfreefn.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\kdmapper_Release.exe"C:\Users\Admin\AppData\Local\Temp\kdmapper_Release.exe" "C:\Users\Admin\AppData\Local\Temp\SofMain1337.sys"3⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:5712
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:236
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\kdmapper_Release.exe
- Size 150KB
- SHA256 5142e2689d47e9f84c831598331db3632f0c268f99bbb7b9cd70543227838776
- MD5 138b840efcfb0db817343f0ff5516d2a
- SHA1 3053d96d21d93fb21305a93f14031413834d2a11
- SHA512 600117f525892fb0afff5b6aaf0551eb2a1e7946fec5114229ba9c7e5a955c5e4f0515e3f6fcd5dbe8850c712cb80bafdfec74953876ab80e98461dcde2852c3
- SSDEEP 3072:8QeuLZ8OB7/Us7sMDcFS0DzbskwBmJTQSaMm5/6Yavg8Y:8gNpBDUs7ncFSQ31JWljfZ
- TLSH T1EFE32A1797A9106EE1B7D6B9CAB24A11EB717C550B74D2CF135048BA0F327D0BA3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH