b36cc9e932421fed1817921a41d4340577a4785f658d8f0e9a2b95ef4444be4f

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
patcher.exe
Size 3.1MB
Sample260730-w2gpbsxydx
SHA256 b36cc9e932421fed1817921a41d4340577a4785f658d8f0e9a2b95ef4444be4f
MD5 d2e7813509144a52aaa13043a69a47bd
SHA1 e37fea7ca629333387899d6a2cc1e623b75cc209
SHA512 dd2b96a49f93f65dd8f0d4d3b1484ed7f36f1c2ebdd63d41cf5a009ce37bb6e1aae8f27420cbb42c500c21655188e3f278a01cbb5e47db147da95f871e570fa7
SSDEEP 49152:h9YjipSp3FsQ9nHnQC3IsOQaTJNZdS5huGnpoEq+uIM9:8dNFsQ9nHGNZdS5huGnpoEq+uIM9
TLSH
T17AE5E74359EB0DA9DED677BC61C36339A774FD31CA2D1F2AA608C13129536C4AD2EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6016	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 6016	4348	patcher.exe	89
PID 6016 wrote to memory of 3000	6016	cmd.exe	90

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	3	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\patcher.exe
"C:\Users\Admin\AppData\Local\Temp\patcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pHash.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\system32\curl.exe
    curl -o "pHash" "http://144.172.71.105:1338/nova_flow/patcher.exe?hash"
    3⤵
    PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pHash

Path C:\Users\Admin\AppData\Local\Temp\pHash
Size 128B
SHA256 135221b6c18d40f8ec6a8b6156b24680b5aab0a9ae05478b579c4e8ccc1beb94
MD5 6ae4ec4e36f0a3c986826cf8f1b91f8c
SHA1 0d25ba45a4befe0072a9381fcd55b5a8fa321b6d
SHA512 7a539b50d71f734c84f610a3d1c08e8642b94d1d55ebbb7904d639887fb1b4cbe19eef5fe8559eeac13ce64d7d5cb5b83578212a3db0e0d97d1a42dcc25124ee
TLSH
T1C5B09B0C986411715C37C7DB74DCFC44F984F95A045C9455256511C5B57F163DAC1151
MD5 SHA1 SHA512 TLSH

Submit Download

pHash.bat

Path C:\Users\Admin\AppData\Local\Temp\pHash.bat
Size 204B
SHA256 fc73cb2ecd77fb5f14af112cff3dcc5b400f52d2fd825e5cc3d22f35b2e8031e
MD5 fb85840f1be69e173fd917e7561c4457
SHA1 be87644d997bbfbb26542397d2b812cc47696a9b
SHA512 26054fb71c88cea7379dd9431fd79402454e3e7f9dff7c6526aa950b60083dd727f4352fe437d5a6fc3b1c2b74b6360c2b9c8727006ef7d316c7e86ec23af03b
TLSH
T104D022AE281BA4421233C4710AB8924FD21B00C3008CEE68798888005FBC38FA3C16EE
MD5 SHA1 SHA512 TLSH