8c2cb505f5fcf908a3d28945d4556f3fe3b42bdbc0f58db2015417cd1116fa39

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 10:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMTKiller.V1.exe
Size 429KB
Sample260808-mhc3csvdph
SHA256 8c2cb505f5fcf908a3d28945d4556f3fe3b42bdbc0f58db2015417cd1116fa39
MD5 d3940cd71fff8fe22047f1e1512d181a
SHA1 bf32993ee1656fb833372b09bb14fbfe3bd0e892
SHA512 19a3d31dd08a6fbb8e46bbf4bdc082ea475c0c4a40f702f27210053aad025ed6f12c925a6c7de750d20436b274de1eea2afef6dcbfbc38a13fe8090991db50ea
SSDEEP 12288:ZEU2YuIQ3XrBWKLZdxt5ln8g6NCyoX2nTS+TBGOyG:ZrvuIQ3dWKtdxtX9fXuTBGOyG
TLSH
T153948EC6B7C6ADE6C10185368DAB43593338F6E116978B07292C72341E17AF1FE8B617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
50	raw.githubusercontent.com
51	raw.githubusercontent.com

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1232	cmd.exe
3020	cmd.exe
1684	cmd.exe
1728	cmd.exe
1168	cmd.exe
4360	cmd.exe
1760	cmd.exe
644	cmd.exe
3444	cmd.exe
828	cmd.exe
2216	cmd.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe
1660	IMTKiller.V1.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1168	1660	IMTKiller.V1.exe	86
PID 1660 wrote to memory of 4360	1660	IMTKiller.V1.exe	92
PID 1660 wrote to memory of 1760	1660	IMTKiller.V1.exe	94
PID 1660 wrote to memory of 644	1660	IMTKiller.V1.exe	97
PID 1660 wrote to memory of 3444	1660	IMTKiller.V1.exe	103
PID 1660 wrote to memory of 3020	1660	IMTKiller.V1.exe	104
PID 1660 wrote to memory of 828	1660	IMTKiller.V1.exe	106
PID 1660 wrote to memory of 2216	1660	IMTKiller.V1.exe	107
PID 1660 wrote to memory of 1684	1660	IMTKiller.V1.exe	111
PID 1660 wrote to memory of 1232	1660	IMTKiller.V1.exe	112
PID 1660 wrote to memory of 1728	1660	IMTKiller.V1.exe	113

C:\Users\Admin\AppData\Local\Temp\IMTKiller.V1.exe
"C:\Users\Admin\AppData\Local\Temp\IMTKiller.V1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1660-0-0x00007FF6A2510000-0x00007FF6A2578000-memory.dmp

Download

memory/1660-22-0x00007FF6A2510000-0x00007FF6A2578000-memory.dmp

Download