36994e3ed288baed8a32757c18e12e913d5b015b64fcd000c4ceeed65ed12949

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 03:33

Target
Kainite Free/Kainite Cheat.exe
Size 390KB
Sample260724-d4enms1sew
SHA256 36994e3ed288baed8a32757c18e12e913d5b015b64fcd000c4ceeed65ed12949
MD5 f120dc655ad2f60daced80f22e1de4ab
SHA1 01a7bdfd63632cc9b8ce44eee8fc5b375ba076e1
SHA512 7ba91a8d3257987a2cff20a7463c23c65592de05cf354e8b053cc1f292e83d7c9afd9a784362402833e073c400cd12c3e1b3a06a5d095848f99b4d22ca13e67b
SSDEEP 12288:55ubz2BcEebBXwqb/imjDWOCAriFno+B:5MjEyBXwqrimnWqiFno+B
TLSH
T18E84AE81F1E444F8D05B613A95AAAA1FEA39385C172089D723FC45583FE33E1A7F6712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

Registry Run Keys / Startup Folder

Modify Registry

Windows Service

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lzNZoaeKnEgAgyippPBCr\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\lzNZoaeKnEgAgyippPBCr"	kdmapper_Release.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
4668	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3340	kdmapper_Release.exe
3340	kdmapper_Release.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3340	kdmapper_Release.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3340	kdmapper_Release.exe
Token: SeLoadDriverPrivilege	3340	kdmapper_Release.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 4668	4388	Kainite Cheat.exe	90
PID 4668 wrote to memory of 3340	4668	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\Kainite Free\Kainite Cheat.exe
"C:\Users\Admin\AppData\Local\Temp\Kainite Free\Kainite Cheat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c kdmapper_Release.exe driver.sys
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Users\Admin\AppData\Local\Temp\Kainite Free\kdmapper_Release.exe
    kdmapper_Release.exe driver.sys
    3⤵
    - Sets service image path in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    PID:3340