d0e271b6b2f46419d13af068ea5abce55a935b8768e4e74036b0753c341220d9

Analysis

user interaction
yes
max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 10:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MistLoader.exe
Size 3.4MB
Sample260808-mzmywsdb37
SHA256 d0e271b6b2f46419d13af068ea5abce55a935b8768e4e74036b0753c341220d9
MD5 d8d95fd970b797c3a263216536a34e09
SHA1 b820b9388f5b6468540cafc7ae759a5ab56fefc5
SHA512 72fdc8ac748e7afa11ef3c2aaa367bbe134aab1219030dc9fef8b4344eb1b3bbae034727e811720814fa9eadd66eb3b91a0b2cf6b32c93727d3808e7fe0b1cee
SSDEEP 98304:+8tSMkgGT9oXQLSTr1CSwC44Cahbidq477XA3NlSQTwWYpHovPS8AoW:+4JqTtLOBr6akdZwNlI9p4PlW
TLSH
T147F53343D467E2BDF931FA32161AF5F198593A274ACF22B22D0AD5C906B54D2C9E7303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion execution upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4344-0-0x00007FF605C70000-0x00007FF606126000-memory.dmp	upx
behavioral2/memory/4344-1-0x00007FF605C70000-0x00007FF606126000-memory.dmp	upx
behavioral2/memory/4344-2-0x00007FF605C70000-0x00007FF606126000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5608	cmd.exe
6072	cmd.exe
2476	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
924	timeout.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 5608	4344	MistLoader.exe	89
PID 5608 wrote to memory of 1944	5608	cmd.exe	91
PID 5608 wrote to memory of 244	5608	cmd.exe	92
PID 5608 wrote to memory of 124	5608	cmd.exe	93
PID 4344 wrote to memory of 6072	4344	MistLoader.exe	94
PID 6072 wrote to memory of 2476	6072	cmd.exe	96
PID 2476 wrote to memory of 924	2476	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\MistLoader.exe
"C:\Users\Admin\AppData\Local\Temp\MistLoader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\MistLoader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\MistLoader.exe" MD5
    3⤵
    PID:1944
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:244
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6072
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4344-0-0x00007FF605C70000-0x00007FF606126000-memory.dmp

Download

memory/4344-1-0x00007FF605C70000-0x00007FF606126000-memory.dmp

Download

memory/4344-2-0x00007FF605C70000-0x00007FF606126000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads