a6c33296f1e68bcd3f8d235983dd1bff711fec0261514834a856f4b09209b384

Analysis

user interaction
yes
max time kernel
12s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EdgeOneMore.exe
Size 117KB
Sample260718-ejg4psay4z
SHA256 a6c33296f1e68bcd3f8d235983dd1bff711fec0261514834a856f4b09209b384
MD5 2481557498ad112b05a66f70d5fa5fcf
SHA1 58b570cd2065dd5e05cc1d1e4284b18779f8f894
SHA512 7a2aa9eedea9b02a33e396fdac736853beffb09c03d657c485a8001ba0e167400f6a9fa95df00fa66209a0fc3b135eee9513414fe949dae4dcdba9d68524227a
SSDEEP 3072:z+FfHgTWmCRkGbKGLeNTBf3w5u6dj+90m/UKz:a5aWbksiNTBvNR9ftz
TLSH
T13BC3AE45F2E102F7EAF2053100E6617F9739A6288724E8DBC78C3D529953AD1A77D3E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3724	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EdgeOneMore.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 3724	2628	EdgeOneMore.exe	79

C:\Users\Admin\AppData\Local\Temp\EdgeOneMore.exe
"C:\Users\Admin\AppData\Local\Temp\EdgeOneMore.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5DCB.tmp\5DCC.tmp\5DCD.bat C:\Users\Admin\AppData\Local\Temp\EdgeOneMore.exe"
  2⤵
  - Executes a command shell one-liner
  PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5DCD.bat

Path C:\Users\Admin\AppData\Local\Temp\5DCB.tmp\5DCC.tmp\5DCD.bat
Size 54B
SHA256 c1640f38f0ffd5b09ac83529f8b01ff6fe0a74f2113fca9946a8d1a6938f66d6
MD5 849818c74128a7d59dee2dc2090419c3
SHA1 d03e63f112c9d0b650218accc7213fe1fa4c46c8
SHA512 3ad4bc12af8efc838416af1d2f942967737597088b92730fb78e90fc3033e3c45424245141c4948d6d8b6ffa023f508d7b211e2b4e14d9343cd50b50696c11e2
TLSH
T15E900201541104033F1248011085555171AF904741428492B02148BD58CE5C970CD59D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2628-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download