c6f6988022933758fd0a3e94005ceb18b9979b23dfbc4e99b2ecb95e7549fa92

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file_dx395lkleqss31.exe
Size 2.8MB
Sample260721-c46lpacy2r
SHA256 c6f6988022933758fd0a3e94005ceb18b9979b23dfbc4e99b2ecb95e7549fa92
MD5 1d4b737581f9091a36ea018632ff90af
SHA1 b2e57f33efa8be36bc8d9fb563742c9cc73a1cde
SHA512 68316f8225bc770bf511e97f1b54602b57d83a41b98545b85e2f71776e3eb082db3a31d0d43cff2b1cb99c13bc9cf9ecebc572dc18f040bdfffca1a1e7a01c14
SSDEEP 49152:uJ6/NglCuQ8koczlFLj+SsEz92khPuxkXBcEQMdIUOOr7+j9t2CyCXXa3xt+wqje:hNglkAWOJirNGyiHHaBmjqfvs
TLSH
T121D5232AB65544FDE507C038864D4BA3AA3979490B22BEFF139803243F267E91F3DB55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4280 set thread context of 3232	4280	file_dx395lkleqss31.exe	90

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5660	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5660	cmd.exe
3076	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3076	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 3232	4280	file_dx395lkleqss31.exe	90
PID 4280 wrote to memory of 3232	4280	file_dx395lkleqss31.exe	90
PID 4280 wrote to memory of 3232	4280	file_dx395lkleqss31.exe	90
PID 4280 wrote to memory of 3232	4280	file_dx395lkleqss31.exe	90
PID 4280 wrote to memory of 5660	4280	file_dx395lkleqss31.exe	91
PID 5660 wrote to memory of 3076	5660	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\file_dx395lkleqss31.exe
"C:\Users\Admin\AppData\Local\Temp\file_dx395lkleqss31.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Users\Admin\AppData\Local\Temp\file_dx395lkleqss31.exe
  C:\Users\Admin\AppData\Local\Temp\file_dx395lkleqss31.exe
  2⤵
  PID:3232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2 >nul & for /l %i in (1,1,30) do (del /f /q "C:\Users\Admin\AppData\Local\Temp\file_dx395lkleqss31.exe" >nul 2>&1 && exit /b 0) & ping 127.0.0.1 -n 1 >nul
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~stub_dbg.log

Path C:\Users\Admin\AppData\Local\Temp\~stub_dbg.log
Size 855B
SHA256 4a43c3a0311f960fb913a823c059cbcc7be61f32480fb1d40adc712c9da11844
MD5 2004ed361c44fce5cbbe34f693c7cee4
SHA1 13ee9d8dd8b881701f527112f94df6af87b6f167
SHA512 9e2a70f583f3e3135adc0c7fecccad6ccdb8cf5d6016d922634d657402c674b47052ff0784da60032942e0b10ce6ee970ca6e269f8108c22f3da2f1d8bc8fa53
TLSH
T1A8111679C7CA2B9E75186C054339F222B623DC291A5D0717577EC13470495553D632BC
MD5 SHA1 SHA512 TLSH

Submit Download