c0ddfe44d9e79a4641b3bf788f9c4bed308e45954ff0a38c4e82115f6175b807

Analysis

geolocation tags

eueuropelondonukunited-kingdom
max time kernel
149s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
edner.exe
Size 15.3MB
Sample260815-aj15csvzc1
SHA256 c0ddfe44d9e79a4641b3bf788f9c4bed308e45954ff0a38c4e82115f6175b807
MD5 fc8f6e0944ac2942947153453eb58607
SHA1 fb27296b9db00fd0768ca3adc7a66bd3acbac086
SHA512 02c0d68460ef0a16dad142a572a7caaa90cb58efc10f21898f52097fc174e449f65ce3ed7cf0a3bdda02f04e1f824325bb1d58dced8da798bc65a4a633b0db95
SSDEEP 393216:oYRQ6fnCE+vKTemcK5JlZObukPQhspq2N:xRF/H+vEvJOukPf
TLSH
T194F623C735FE82ACC4929631DA851BFAF48874990DB9852F7FCA0C01B932D55CCE9A35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
952	edner.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5924	powershell.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	edner.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3624	edner.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2972	cmd.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	edner.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312265357809472"	edner.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5924	powershell.exe
5924	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3624	edner.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3624	edner.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	3624	edner.exe
Token: SeDebugPrivilege	5924	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 952	3624	edner.exe	89
PID 952 wrote to memory of 2972	952	edner.exe	90
PID 2972 wrote to memory of 5924	2972	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\edner.exe
"C:\Users\Admin\AppData\Local\Temp\edner.exe"
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Users\Admin\AppData\Local\Temp\edner.exe
  "C:\Users\Admin\AppData\Local\Temp\edner.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command ^"^& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'Edner', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }^"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'Edner', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

edner.exe

Path C:\Users\Admin\AppData\Local\Temp\edner.exe
Size 15.3MB
SHA256 c39ab90fc205af0e92da72da2975d36f2b76a142be10c55124bf8f47069330df
MD5 5ff8dd38e8ba2b70e1c0c456fd89095e
SHA1 38b3bae34544b33b2b8248da9f3752015e2039cc
SHA512 a512bde7f73712d09779a5f9cc1bc6d6d6ecdc1e0e507707b1a4334cf4b42eb6dbec780adf161c781cfd9fb35c77d72a23498fb965240cfaf25a5212bd1f63fb
SSDEEP 393216:oYRQ6fnCE+vKTemcK5JlZObukPQhspq2Nz:xRF/H+vEvJOukPf1
TLSH
T175F623C735FE82ACC4929631DA851BFAF48874990DB9852F7FCA0C01B932D55CCE9A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edner.exe

Path C:\Users\Admin\AppData\Local\Temp\edner.exe
Size 15.3MB
SHA256 64da82690adc43c1feae115a7d48398c77979928f8077321952d512093fab84f
MD5 da9bc7c0ab82b44e09095b5810fbc3c2
SHA1 cd5f32516b4d16bb14a4b92e161747ec473fb9ec
SHA512 6e99d9942117181123c7db47f875f765f1f94a64be31e8436194b90dfa6d4c7707c43c3364a7f74cccb6d33cb9f39565041c0244572003b58727075357c724b3
SSDEEP 393216:oYRQ6fnCE+vKTemcK5JlZObukPQhspq2N8:xRF/H+vEvJOukPfa
TLSH
T1F8F623C735FE82ACC4929631DA851BFAF48874990DB9852F7FCA0C01B932D55CCE9A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/952-35-0x00007FF799710000-0x00007FF79B4C6000-memory.dmp

Download

memory/952-79-0x00007FF799710000-0x00007FF79B4C6000-memory.dmp

Download

memory/3624-0-0x00007FF6B7C50000-0x00007FF6B9A06000-memory.dmp

Download

memory/3624-34-0x00007FF6B7C50000-0x00007FF6B9A06000-memory.dmp

Download

memory/5924-78-0x00000249E2B80000-0x00000249E2BA2000-memory.dmp

Download