a9f7b078e819abbe6b9c34ea943b43bad9e1e25db56894bdb7cee03f522ed7eb

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Codex 2.exe
Size 438KB
Sample260814-dmebjstcph
SHA256 a9f7b078e819abbe6b9c34ea943b43bad9e1e25db56894bdb7cee03f522ed7eb
MD5 c8d7e6e414476ed802036b126ad9e6fc
SHA1 ae776cd6faae255eef3c1dc2bdfbb41a35c2d61d
SHA512 aef13ee78022005dc35eaf1649e80ae24b983842f951a1f1c63949a44ce574c748067b7fec6123763f45e0e7209e35f009d86796b5b12addafde641b3b930ff8
SSDEEP 6144:ACSFWgfVcbeIhlT9/PCiC5S09gssSWnh6dMCDUva3mQgaaSPUikgiPnpv8NnR6T:EFY9lxXYWnh6dlDYMgvYiPnZ8NR6T
TLSH
T1F8A4AF85F1E444FCD02B913896ABBA0BEA393418132056DB63D4E5AC2BE37F497F6351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
408	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 408	4664	Codex 2.exe	90

C:\Users\Admin\AppData\Local\Temp\Codex 2.exe
"C:\Users\Admin\AppData\Local\Temp\Codex 2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads