adbecab72b3f6664203021a9f8940046051b377b96f2603e5ba9d9436bed03a4

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
m5yqapkz24pns5c5.exe
Size 666KB
Sample260816-msl31swtbv
SHA256 adbecab72b3f6664203021a9f8940046051b377b96f2603e5ba9d9436bed03a4
MD5 e3e1b86f1a2bd518326a9297298730bc
SHA1 ca59c333f04bb4aff2c803166a5ec502f8187493
SHA512 6e512576d524e4d65bac7f4cc6b356648dbacc01adfb0200489d3ee7aaf66542eae751640897177c3713666646be93759323ec7f7abb81a03ac3b948ee20dd6c
SSDEEP 6144:wJ8lA52XERAyxu360AGPChTx6ixAUnc2fggrBm1Q+/JqI3uzCMWqD5Ynh0iOqAhH:742XERDPqqL5YiqAzCHYXstM2F+
TLSH
T190E484243B95AE41E540163E82BE1618D732A0F32312AB47370BF7615D44AFEED6D3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
1812	MalwareDef32.exe
2564	MalwareDef32.exe
2360	MalwareDef32.exe
1276	MalwareDef32.exe
2440	MalwareDef32.exe

Looks up external IP address via web service 1 TTPs 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
7	api.ipify.org
8	api.ipify.org
14	api.ipify.org
15	api.ipify.org
16	api.ipify.org
17	api.ipify.org

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\MalwareDef32.exe	m5yqapkz24pns5c5.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3220	cmd.exe
4920	cmd.exe
1688	cmd.exe
4620	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6108	schtasks.exe
3564	schtasks.exe
4576	schtasks.exe
4524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
1812	MalwareDef32.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe
4140	m5yqapkz24pns5c5.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	m5yqapkz24pns5c5.exe
Token: SeDebugPrivilege	1812	MalwareDef32.exe
Token: SeIncBasePriorityPrivilege	1812	MalwareDef32.exe
Token: SeDebugPrivilege	2564	MalwareDef32.exe
Token: SeDebugPrivilege	1276	MalwareDef32.exe
Token: SeDebugPrivilege	2440	MalwareDef32.exe
Token: SeDebugPrivilege	2360	MalwareDef32.exe
Token: SeIncBasePriorityPrivilege	1276	MalwareDef32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 5996	4140	m5yqapkz24pns5c5.exe	90
PID 4140 wrote to memory of 3220	4140	m5yqapkz24pns5c5.exe	91
PID 3220 wrote to memory of 6108	3220	cmd.exe	94
PID 4140 wrote to memory of 4920	4140	m5yqapkz24pns5c5.exe	97
PID 4920 wrote to memory of 3564	4920	cmd.exe	99
PID 4140 wrote to memory of 1688	4140	m5yqapkz24pns5c5.exe	100
PID 1688 wrote to memory of 4576	1688	cmd.exe	102
PID 4140 wrote to memory of 4620	4140	m5yqapkz24pns5c5.exe	103
PID 4620 wrote to memory of 4524	4620	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\m5yqapkz24pns5c5.exe
"C:\Users\Admin\AppData\Local\Temp\m5yqapkz24pns5c5.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="xybIjdQ0jbX!jp" dir=in action=allow program="C:\Windows\MalwareDef32.exe" enable=yes & exit
  2⤵
  PID:5996
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\MalwareDef32.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\MalwareDef32.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6108
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\MalwareDef32.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\MalwareDef32.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3564
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\MalwareDef32.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\MalwareDef32.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4576
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\MalwareDef32.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\MalwareDef32.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4524

C:\Windows\MalwareDef32.exe
"C:\Windows\MalwareDef32.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1812

C:\Windows\MalwareDef32.exe
"C:\Windows\MalwareDef32.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2564

C:\Windows\MalwareDef32.exe
"C:\Windows\MalwareDef32.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\MalwareDef32.exe
"C:\Windows\MalwareDef32.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Windows\MalwareDef32.exe
"C:\Windows\MalwareDef32.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MalwareDef32.exe

Path C:\Windows\MalwareDef32.exe
Size 666KB
SHA256 adbecab72b3f6664203021a9f8940046051b377b96f2603e5ba9d9436bed03a4
MD5 e3e1b86f1a2bd518326a9297298730bc
SHA1 ca59c333f04bb4aff2c803166a5ec502f8187493
SHA512 6e512576d524e4d65bac7f4cc6b356648dbacc01adfb0200489d3ee7aaf66542eae751640897177c3713666646be93759323ec7f7abb81a03ac3b948ee20dd6c
SSDEEP 6144:wJ8lA52XERAyxu360AGPChTx6ixAUnc2fggrBm1Q+/JqI3uzCMWqD5Ynh0iOqAhH:742XERDPqqL5YiqAzCHYXstM2F+
TLSH
T190E484243B95AE41E540163E82BE1618D732A0F32312AB47370BF7615D44AFEED6D3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1812-19-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp

Download

memory/1812-18-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp

Download

memory/1812-17-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp

Download

memory/1812-14-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp

Download

memory/1812-13-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp

Download

memory/1812-12-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp

Download

memory/4140-4-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp

Download

memory/4140-9-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp

Download

memory/4140-7-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp

Download

memory/4140-6-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp

Download

memory/4140-5-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp

Download

memory/4140-1-0x00007FFA442EF000-0x00007FFA442F0000-memory.dmp

Download

memory/4140-3-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp

Download

memory/4140-2-0x00007FFA44160000-0x00007FFA44B04000-memory.dmp

Download

memory/4140-0-0x00000272C6360000-0x00000272C640A000-memory.dmp

Download