ad418ef1a0f91f000f45bc1ef67c17682dd0cb66a73a32012a64849f08e6697c

Analysis

user interaction
yes
max time kernel
52s
max time network
53s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chloride.exe
Size 8.2MB
Sample260726-1mryzagc45
SHA256 ad418ef1a0f91f000f45bc1ef67c17682dd0cb66a73a32012a64849f08e6697c
MD5 0db8c9326ac631d67b671ab2d0752b99
SHA1 3d5fc2b7e9adf1c3890f1d5293a1a808bf1f0da4
SHA512 9e7f7028067842b8db5f70ab1edbc5dcc18afbd0e0a027c56fcac6f0b4408f2b6df92067e91f81da56ab3a081bab7d6736c8e52ab4596627d996e17c6f38fc00
SSDEEP 98304:dCXUpdojPJw80Rp7XcO17XplbNwSuQrrIX:dbUJB0HXZVXp0
TLSH
T172866B1BE7B610D5D0BBC13ED553522AFD7134A5833897DB52C08A5A2F22BE4AE7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5740	cmd.exe
3364	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1476	2804	Chloride.exe	89
PID 2804 wrote to memory of 5740	2804	Chloride.exe	91
PID 2804 wrote to memory of 3364	2804	Chloride.exe	92

C:\Users\Admin\AppData\Local\Temp\Chloride.exe
"C:\Users\Admin\AppData\Local\Temp\Chloride.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Users\Admin\AppData\Local\Temp\Chloride.exe
  "C:\Users\Admin\AppData\Local\Temp\Chloride.exe" --stealer
  2⤵
  PID:1476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:5740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

498A11AEF3ED206C64B709F787440F72

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\498A11AEF3ED206C64B709F787440F72
Size 310B
SHA256 bbc96f52d537321eb6877b475c0d8b242ece8290c09bc17f8d58c63da03cac5d
MD5 a8fd2c4250341bd10d02ba2972b86039
SHA1 47e1a5862ded0f194e8933847da6ae16ff76ad83
SHA512 e089546b1d7cf593705ee1ea6b7c84f387c7ff8ab10f446a52a077919832ae0305a98df6330354d05219f0f28752d05a8cbac67e263732718de504f081f26dfc
TLSH
T1C6E07DA19A7937C01770F204DCD5CCA72CB840820A0FB401A910C7A208A3749A5800C9
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

498A11AEF3ED206C64B709F787440F72

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\498A11AEF3ED206C64B709F787440F72
Size 192B
SHA256 b9d5b324b3ddd2e587b86995d49f431c47c5c245b32600a786444e2da8f8cd2f
MD5 b0ea46a41a87d90c127cdf2f8899ea46
SHA1 fd7824335cd4acfb92e5e1b01bddc9c8b13bfcac
SHA512 3cebddfb8ef269ec175646c9bf6148f04b8bac8359107ea0c027fd9c302a2e79e00a546bbc2e38f8b501d9fe47955dc47a7ae65cdc5c138a5c67a5df078fc60f
TLSH
T14CC08C213A33014CF601633E88D19BC11BF8FB04915187080F7402284A19A016C30E2B
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 7c70df1cf610e920bbc4aac26ce4edad52f5404ac990297db0e0f45c7b754fb1
MD5 48c52d3a10ea1869fc8f4e1d910b415c
SHA1 8a962699d23f55d033d9e7c59ccaf8992c5d9925
SHA512 b2aa9339b6be3811b0db011dd197290c0e9930ea42d8a4cf8201201cf819fbe5db694d1b7321e0ebb06264311eb48155d7b2be03bd6d505f7fb6397747fb2b27
TLSH
T1A2C02B0433B20155F1300D7F1683630147FAF105CDC183000F30221CC11CB024CF0C02
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 4880330f440fa95530ca654954abc6b39f290c48836000d832137a23d46df984
MD5 132d2622379a6c3df409fcda7faccc23
SHA1 da5f035f55015f573ef5c7ee026357d1bc2c51ce
SHA512 19e79bad2b22e921ebda7780ddb94e1c887bdf7d9ba1d08be37399514e3c2bfd29604e35b966a8631b84adea705fcbe8ffbd9e3f6d7fbd9d7e407d730001c580
TLSH
T10CC09B1473A54715F10D217D79D516041BB9C505F5D6C7044B74113485286400872D05
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1476-1-0x00007FF6C6B80000-0x00007FF6C74D4000-memory.dmp

Download

memory/1476-20-0x00007FF6C6B80000-0x00007FF6C74D4000-memory.dmp

Download

memory/1476-21-0x00007FF6C6B80000-0x00007FF6C74D4000-memory.dmp

Download

memory/2804-0-0x00007FF6C6B80000-0x00007FF6C74D4000-memory.dmp

Download

memory/2804-19-0x00007FF6C6B80000-0x00007FF6C74D4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads