5011bba17e1bbaccdb5f8f2088f6f6f7cc4d83b983a9cebfada2cc0e34df4f12

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
opseclordgZak8Hk6g.exe
Size 1.0MB
Sample260805-tkmsxa1bkg
SHA256 5011bba17e1bbaccdb5f8f2088f6f6f7cc4d83b983a9cebfada2cc0e34df4f12
MD5 4196b9cb0db492b134417bbc75ae53d0
SHA1 b8b6b81cb9dbf46b83356db711ca4a04794c5604
SHA512 79561f1c0dcdf4ec1fb8eb95c9b9458c9d6d7755cb454d7263f679945a889fcb25476fc582f29eb99dfad1a0b818774b6114965dc0538ac2907e3941ec5f7c9f
SSDEEP 24576:0+inCMzF3tw8x5OE7iueF4vRyNZ5TD+z4OgDnEJt91/:h3MzF9Rq0Rc5Taz4OgDnGt9
TLSH
T16135AD207A950829D466C1B4D383B573EE35B0C20FACF4EF53990234EE5ADD59B78E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6728	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7080	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6728	powershell.exe
6728	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6728	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6568 wrote to memory of 6728	6568	opseclordgZak8Hk6g.exe	91
PID 6728 wrote to memory of 7080	6728	powershell.exe	93

C:\Users\Admin\AppData\Local\Temp\opseclordgZak8Hk6g.exe
"C:\Users\Admin\AppData\Local\Temp\opseclordgZak8Hk6g.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "Unblock-File -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\deploy_ku88nK4SRp9ecqjh.bat' -ErrorAction SilentlyContinue; Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\deploy_ku88nK4SRp9ecqjh.bat' -ArgumentList 'silent' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\deploy_ku88nK4SRp9ecqjh.bat" silent "
    3⤵
    - Executes a command shell one-liner
    PID:7080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deploy_ku88nK4SRp9ecqjh.bat

Path C:\Users\Admin\AppData\Local\Temp\deploy_ku88nK4SRp9ecqjh.bat
Size 658KB
SHA256 86ccc4c04e0e865c796e03a9e3f098a342c7e13e2ab827546fd84dd837e4d38e
MD5 dcabe9bc714e025fb7177c8e91d830d8
SHA1 29f09af686db6ccfbef2149b2d646022257a99ff
SHA512 dbe73388c3986ca30822521559fe9c9b2919608ab5e7f648fdc71b92fd91e71ec9c78a693e5d8a2c278e855c894efdd3eb569ac725d923614ca679b159ae507d
SSDEEP 12288:VDx/ZX/J4EtRixafleFMDKuv4b4yXdZJlJUzEmeDlKDzXVmOgttwAwpb:5x5OE7iueF4vRyNZ5TD+z4OgDnQ
TLSH
T14DE4E17879C50D1BAAF2166AF4D2C503FB79C1C30A3455CED1EE0249438F889E7B962E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6728-10-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6728-3-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6728-7-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6728-8-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6728-9-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6728-2-0x00007FFB0B1BF000-0x00007FFB0B1C0000-memory.dmp

Download

memory/6728-11-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6728-12-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6728-13-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6728-16-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6728-17-0x00007FFB0B030000-0x00007FFB0B9D4000-memory.dmp

Download

memory/6728-6-0x00000163FADA0000-0x00000163FADC2000-memory.dmp

Download