688aa4b277f8fb8e30764c9ea0791f3522f929b897f3e5234b47fddc33a39f85

Analysis

user interaction
yes
max time kernel
20s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
𝕭ella 汰_loader.exe
Size 915KB
Sample260809-p2schafj7z
SHA256 688aa4b277f8fb8e30764c9ea0791f3522f929b897f3e5234b47fddc33a39f85
MD5 bf806e53bd53f71c5efe49420293776b
SHA1 4907c6bf3465dfd286593e418385982f8fdff700
SHA512 fb836e26200038194cf6d6a758d5031acfb14982dcafcb72a37eb1e896eb26eae8894b038688497708d5a4687b42da8c09e5b1f657610745dd86159b54b4318e
SSDEEP 12288:Lecicflv0EKadUcCbfFB1Y5fWIdyw+G1bNcdhg19Oa6m2cuA:LeTcflv3dUcCbfFU51hcdhg19OaC
TLSH
T1E9152A1BE6B345E8C52FD07887539772AE70B86A01247D2E1EA8D7325F21E509F6F720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4412	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 4412	3796	𝕭ella 汰_loader.exe	88

C:\Users\Admin\AppData\Local\Temp\𝕭ella 汰_loader.exe
"C:\Users\Admin\AppData\Local\Temp\𝕭ella 汰_loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3796-0-0x00007FF6D2920000-0x00007FF6D2A0B000-memory.dmp

Download

memory/3796-1-0x00007FF6D2920000-0x00007FF6D2A0B000-memory.dmp