a986abaa4725a518960101410d77ba1b56e3ec4e51d7ff4bce76e98d2b8c430e

Analysis

user interaction
yes
max time kernel
598s
max time network
399s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/08/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Release/kokoro.sys
Size 5KB
Sample260802-c8ptqsbr81
SHA256 a986abaa4725a518960101410d77ba1b56e3ec4e51d7ff4bce76e98d2b8c430e
MD5 325ed9a0320f07bac4956ef23a050da8
SHA1 066772b9393d893ddfb01b93c4792cf02c5bd597
SHA512 27e4bea56386353d9aab4e1dafa279b88482baf018cd84e25a1c22133b0c286b3e71b563072ce05e0c1c630cf948b7f95e17bf9782b6a03a73900c4e428b40c3
SSDEEP 48:aorC+NvowSAdQbUdsDraNDyVyqEhIhLATAoy5R1h6:LDXd0ksD+NDyVbf5D
TLSH
T1BEC13150753284E3E11A80BDC9864958B3B9F05027515BDFD84861654A46FDEBE39E83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4700	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Release\kokoro.sys
1⤵
- Executes a command shell one-liner
PID:4700
- C:\Users\Admin\AppData\Local\Temp\Release\kokoro.sys
  C:\Users\Admin\AppData\Local\Temp\Release\kokoro.sys
  2⤵
  PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads