5b484a1dac667cc70d764345abba364bd64974065eaf25565d07ccca946b2207

Analysis

max time kernel
298s
max time network
250s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 20:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KMapperDriver.sys
Size 7KB
Sample260804-y799yayhnd
SHA256 5b484a1dac667cc70d764345abba364bd64974065eaf25565d07ccca946b2207
MD5 f0315085c0d78225c3b186caf923d305
SHA1 d62ebb3d17f9f65934ce0389994be71decf60f00
SHA512 723ab4558883aa768593f1a8cce0d9ac746433d88e185f3ea096c22a6b39e41073b69394cfe2d19e5ab7b44cc91382dc138d6d75a2a7ca5d4c7652c2bd27c58f
SSDEEP 96:ZIGbzrNDtQIYs02M3gbM470vV4xnH538k0PNyUfHTqdNr/oEe:ZIEzNtVq7Kz70vCxH538k0Fy0qG
TLSH
T12CF1C8E1936279E9F049413B176BD315E9B233101716C7DF92D88F3D2308A867AA9E89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3956	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\KMapperDriver.sys
1⤵
- Executes a command shell one-liner
PID:3956
- C:\Users\Admin\AppData\Local\Temp\KMapperDriver.sys
  C:\Users\Admin\AppData\Local\Temp\KMapperDriver.sys
  2⤵
  PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads