7650821185661c85453cc2027ca6241ed6ff5e4610760caa7412ea9c1457b12a

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7650821185661c85453cc2027ca6241ed6ff5e4610760caa7412ea9c1457b12a.exe
Size 5.3MB
Sample260817-ee2bsaek2x
SHA256 7650821185661c85453cc2027ca6241ed6ff5e4610760caa7412ea9c1457b12a
MD5 5140fb63c1de794e3ae1270360c7fa5e
SHA1 fa4049b0366001bfeac69a520eab9d0e4f826993
SHA512 4ec8416332fc3c19d4a07ddeee61e5bf0b3976a0d2b8236899da1833ec1fe8b53e3ade40c5f376ea6f293e0c0f112635994f478f2598ce4fe9643b41c83becb4
SSDEEP 98304:8KAQ58Eek+V0VyZG1vCqLfWrtX6FmrH9HTk1hlWcsrpyPVb7pG:8o+kYZenotX6IrH9HTwbWub7pG
TLSH
T195462349E7A405FDE4A3D1B8DD820A17F7717C9907A19BDF13A0A9A21F233905E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\DriverData\patch.exe	cmd.exe
File opened for modification	C:\Windows\System32\drivers\DriverData\patch.exe	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
5264	patch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5740	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 5740	3332	7650821185661c85453cc2027ca6241ed6ff5e4610760caa7412ea9c1457b12a.exe	89
PID 5740 wrote to memory of 5264	5740	cmd.exe	91
PID 5264 wrote to memory of 3212	5264	patch.exe	92
PID 3212 wrote to memory of 6084	3212	csc.exe	94
PID 5264 wrote to memory of 1900	5264	patch.exe	95
PID 1900 wrote to memory of 5412	1900	csc.exe	97

C:\Users\Admin\AppData\Local\Temp\7650821185661c85453cc2027ca6241ed6ff5e4610760caa7412ea9c1457b12a.exe
"C:\Users\Admin\AppData\Local\Temp\7650821185661c85453cc2027ca6241ed6ff5e4610760caa7412ea9c1457b12a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\setup123.bat" "
  2⤵
  - Drops file in Drivers directory
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Users\Admin\AppData\Local\Temp\patch.exe
    patch.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\juil4ygb\juil4ygb.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3212
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2159.tmp" "c:\Users\Admin\AppData\Local\Temp\juil4ygb\CSC5E6C6DDB89EF4B249E647870C4B5AD7E.TMP"
        5⤵
        
        PID:6084
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\juil4ygb\juil4ygb.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1900
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES22D0.tmp" "c:\Users\Admin\AppData\Local\Temp\juil4ygb\CSCBC763E702C7E4795A2D5BAB27EA424F0.TMP"
        5⤵
        
        PID:5412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES2159.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2159.tmp
Size 1KB
SHA256 78237133e21371af0f072910a32c193260f792a157bd36ee3b432e18985c7fab
MD5 2240b2ec7cd435a113245752ea53bec5
SHA1 54f26cdb4282fcc860e30f8abf3215785785f365
SHA512 841663b093969be4f11aece4ba765fd8b1b8c999aaeb136ab885f7b3bf6f933f93144a2bea6e659e13331a27270a8e93262d9408dad3d18f0068aa2b15d80ecb
TLSH
T13D21CC0553E94B0FF0B357316DF5132F9234FD65EFA1935A9640422C2C51504EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES22D0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES22D0.tmp
Size 1KB
SHA256 1a46bf507443895d37beb2f2b63896ff69c53a234ec2e9c6038f658cbbba705c
MD5 7ba03d27b55c461bc4371abe9ae3ded9
SHA1 c35c9840843b18d5f1d3075985bf53e17c86ead9
SHA512 51672aa983a788da4cedc66cbe94974d0b849df936f5cbf29c8e66a637f1981a5dee6e14c11a8e2571bcf9e329b57587410ecbe64cb7d9ff9df67936da825c01
TLSH
T19721CC0593E9470FF0B357316DF6072FA278FD65EFA1A35B964042282C51514EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

juil4ygb.dll

Path C:\Users\Admin\AppData\Local\Temp\juil4ygb\juil4ygb.dll
Size 3KB
SHA256 d76f30ed041ada9be1b2a039722eee7b70a14598e51202a66d0c3e4daa5a25e3
MD5 c5ccbde3d5e10e06e570782dc8df7f56
SHA1 6d4d3206640c7cf8de758b79ca6cb4a02ecc00d1
SHA512 4c1a8ae0c4e73048d16a711a57feea26aa7feaf8b824c8c64f626b1f90db79819cac2c0fd5d3b829974ea1e0df0bee71b1f9d777ba682c6eed8aa4a83417475e
TLSH
T18071E21653E8426FE4BB4771EEF3831326B4F860AB62577D1E8012296C943346E71F71
MD5 SHA1 SHA512 TLSH

Submit Download

juil4ygb.dll

Path C:\Users\Admin\AppData\Local\Temp\juil4ygb\juil4ygb.dll
Size 4KB
SHA256 7ef8b84feea29ef53bdf63a0f0d1eae60ebc847f292f813dd5509e5899572686
MD5 8bdc4c87337006fb461bc395fe28680e
SHA1 032a3268bec51c79925e7e1538b766a8dc646881
SHA512 cc029fde0eb22c02444a6ed2b8f0f6ac5a5fa679797ab1d5f84f7b01ab21f2dd609d5a93a18169f5c71d3ef6708ab8ffc9bd314e8db4b11b73386d221e85f357
TLSH
T14881230663E94A17F4BF4BB0ADF3431626B4F964AF66D36E1980221C6CA1234AD61F71
MD5 SHA1 SHA512 TLSH

Submit Download

juil4ygb.pdb

Path C:\Users\Admin\AppData\Local\Temp\juil4ygb\juil4ygb.pdb
Size 11KB
SHA256 131851a11a8fd80b8b7c2f4b4c440359fbecd99b65162bd76c4bc12939606e41
MD5 264801ef0cfff809d8fadd498791135a
SHA1 6333118a7433a3aae1559f57fa9da48037f3377b
SHA512 fd1cd24591061a6da225614972649e52cd8a2416e486b71ea30af92adcc46c36145aa4eb7cc9b8634b9f57e43aa4086b8ccd6984152d763077411ec946169044
SSDEEP 24:zZms4hZj3wGx8wzB25PjGQDkUHXBnM7Gs9yPDeH2QztbU:zZGAQ256aJM7g7eH2Qzt
TLSH
T10432A7103792E631C40462B58CC78BCD4720FC169EC99B5B3780772E3CBA189AED05C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

juil4ygb.pdb

Path C:\Users\Admin\AppData\Local\Temp\juil4ygb\juil4ygb.pdb
Size 11KB
SHA256 4ef3e0143d0bed830b3d6f792e663d313faa471adf9f50e5a86eb70fd4fc8db0
MD5 5bb6443322968ed5a1407bcf41c6f935
SHA1 de6d47585dac41067276167c2e43d307e8d9670a
SHA512 1ee8b18a6533eaeda854cd0f397bf5adb9b7002223a5dc2a317f849ce80827d2b246ea2e519e96f846c372c5bd927cf88b3e2cb7e34ab54ac1fdf5abca8f68c1
SSDEEP 24:zZmsawZj3wGx8fL25PjBQuoUBKnhwqpNPGGFa5AxyP9eH2Qz5nU:zZw2Ap25FQnOqpNPPUFVeH2Qz5
TLSH
T1013257813B87D631D01856788DEB87CD5760FC569FC9939B3241B32D3CBA6C99DD0690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patch.exe

Path C:\Users\Admin\AppData\Local\Temp\patch.exe
Size 13KB
SHA256 9b5ff51fc4b10f91ea4248f73359a5ce042f837dd424200bfab167b4fb5feb85
MD5 c1430dc38192984a989a9c13d2f54d49
SHA1 3e746eb2b388daf2fa3dda4a8e6d3594b3ccf6af
SHA512 352787e136350cef5d109dbc5c6730240d752e33de65b2fe2114a1f3f72c44973fa290b3c0e0f10710ba4a03e83e5e072f2d294de10ff509d220db9c2104b436
SSDEEP 384:tRDvO1Ycn+9lrShtLU0a0/HFTWrk7+BL6OMMW:/7wGAE0I4Cs
TLSH
T1AF522954BBE88737DAF71B765C33105407B6FA016E22CF9E9CC5204A99A2F044756B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup123.bat

Path C:\Users\Admin\AppData\Local\Temp\setup123.bat
Size 189B
SHA256 1ace23e9b1841a1feb78a164927f8a12fc4e698f1da5026d4a947cc9e760127e
MD5 7fce0ecd105c13c93cf42d762d649888
SHA1 5a4b6d973d8ff1b1b3eb30dca22404df82092fce
SHA512 6620045d69caa9659ca30683f6351f8761f24096c7877a1303e5a6b10593d2988f4e63451b0549c14eb0fa00dbeb4e5caf3d02da99e4fbf8889c6913ae516c3d
TLSH
T104C012F10FD08471D0650D40551BD365E751F68D67F5543413E33184F50580D3E90C7D
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5E6C6DDB89EF4B249E647870C4B5AD7E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\juil4ygb\CSC5E6C6DDB89EF4B249E647870C4B5AD7E.TMP
Size 652B
SHA256 d392bb91bc82232fa9a1d5ba0743970b9c52825d2a89f88bae8eb25b3990a4dc
MD5 562c489042e2d637d8970aa360485a2b
SHA1 b0499fc3af296ab26e7b6aa0a2d4bac1dd46cdd0
SHA512 54628badc91bbaba41b0d9dd3a7a9abcf33ce946b15debfac055e4b2cfd2d935c1fe7f8eeb9085cff9405ae99701c52fc1581b6e2f9f090a8fec269c302b0af9
TLSH
T1C3F05E4963F8020EF5F34B70BDF643A391A9BC65DE3293ED2940031D28645208A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

juil4ygb.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\juil4ygb\juil4ygb.0.cs
Size 82B
SHA256 dc4fe976865cf1f53de8f1f81206fbb0c1c562a96c90f57c4cd5bfb0ffecbcd9
MD5 9bc16e67b2cefd03bee7e7af74eb78f3
SHA1 de2d546df11efac03ef38c73a7662ac662cd0da5
SHA512 b45020fe02f6bc72c136cdfec49ad9844de9f9a9e60942fd2e785488e1277da73efc111c7bc3c096580f2091e3e3ea184844f0aa068e63b4bcd11619aa6a51df
TLSH
T1E5A012105E79D432564201D7A2240452B120C06442843400E8B01C9331020044438519
MD5 SHA1 SHA512 TLSH

Submit Download

juil4ygb.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\juil4ygb\juil4ygb.0.cs
Size 283B
SHA256 7f3b52e5000161d78b030777007a2451d0ed9faa665eed4f7efb5d50a9f3fa08
MD5 13af16a9bb03578b8e7c4b7388d15859
SHA1 d39f36b70a29d61dfadd05d672fd5c99fa485125
SHA512 216321225446b47ce4afd94fc20e762fb6c42a1b68e8df7e312bd9145b873ac234c84708564284d5a9bd8b62001b85c876a250d89fc5461f8840b7d6bd29c398
TLSH
T1B4D0EBC02236EA300AC6640224FAFEBAFAB093248038C030B0C69C0DD02C230BBB0C26
MD5 SHA1 SHA512 TLSH

Submit Download

juil4ygb.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\juil4ygb\juil4ygb.cmdline
Size 914B
SHA256 bbaf265c759978acaa8189faf14d7b44d77fcd6e3cdaaec9fc619c722fd4ef7a
MD5 52923e1324bc5dee44c1156ec51bb5db
SHA1 4a0f2ad1ac72d38f6fdf6da4d1c28e635ed6a9a5
SHA512 81c22c28b728810349513395c439170a673fcd7e11faa1e6a6ce9df1a04817f71ea108de0269644ee44ea62f7ff8840acb653e8e0b749659c5d09fb060dfe144
TLSH
T1BF112335033BC6F7C6B63843489E5F9C9267535F3082DF287A89AD6AE9974154E10B90
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5264-20-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/5264-21-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/5264-38-0x0000022B47C50000-0x0000022B47C58000-memory.dmp

Download

memory/5264-25-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/5264-19-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/5264-44-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/5264-18-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/5264-54-0x0000022B47D80000-0x0000022B47D88000-memory.dmp

Download

memory/5264-17-0x0000022B45E80000-0x0000022B45E88000-memory.dmp

Download

memory/5264-16-0x00007FF964A4F000-0x00007FF964A50000-memory.dmp

Download

memory/5264-55-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

memory/5264-27-0x00007FF9648C0000-0x00007FF965264000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads