fdddc5f2d005696b1923e8192a0f66b599dbf92aff40447869f2c278a736c50c

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wave.exe
Size 9.6MB
Sample260818-29pmssaq21
SHA256 fdddc5f2d005696b1923e8192a0f66b599dbf92aff40447869f2c278a736c50c
MD5 1852c2d25f644263c7beb6fd8183e3bd
SHA1 380d73cc5e4edb0640a8911fcf39846974c734ca
SHA512 d7e49f7d0fe95c1f0f00a9ab815e121024d327c28aa66e2646b2366b0f0e702ccec741d7f0adae8c236f489d423e4eb3dc51410aa395bba42943363190069b19
SSDEEP 196608:2DyDXOliXInuU6ljcYtRRoyqgFk99AamtOjNswoTu5evlQm2mtnMUwEa9BeLibsF:2aKnd6lLBSgC99Ai5sw0u5evlQm2mtnj
TLSH
T128A6011897E85552D73E9B7CC126C543FEB1B886032592CF0818FD582FEB7C2A636636
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution themida

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
204	Wave.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000d00000001c586-58.dat	themida

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5644	tasklist.exe
1592	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
204	Wave.exe
204	Wave.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4232	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2460	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2460	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	704	Wave.exe
Token: SeDebugPrivilege	5644	tasklist.exe
Token: SeDebugPrivilege	1592	tasklist.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 4232	704	Wave.exe	89
PID 4232 wrote to memory of 5644	4232	cmd.exe	91
PID 4232 wrote to memory of 4884	4232	cmd.exe	92
PID 4232 wrote to memory of 2460	4232	cmd.exe	94
PID 4232 wrote to memory of 1592	4232	cmd.exe	95
PID 4232 wrote to memory of 2448	4232	cmd.exe	96
PID 4232 wrote to memory of 2880	4232	cmd.exe	97
PID 4232 wrote to memory of 204	4232	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\Wave.exe
"C:\Users\Admin\AppData\Local\Temp\Wave.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:704
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_98faf2910a4c4123bfae349847220646.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 704"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5644
- - C:\Windows\system32\find.exe
    find "704"
    3⤵
    PID:4884
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2460
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 704"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1592
- - C:\Windows\system32\find.exe
    find "704"
    3⤵
    PID:2448
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Temp\WaveUpdate_3f4f45187d17453b88def4e8b230f5c6\*" "C:\Users\Admin\AppData\Local\Temp\" /S /E /Y /R /H /Q
    3⤵
    PID:2880
- - C:\Users\Admin\AppData\Local\Temp\Wave.exe
    "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Wave.exe

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_3f4f45187d17453b88def4e8b230f5c6\Wave.exe
Size 13.2MB
SHA256 cb3fdd72eeb1e87df8414ccc105814eae2d491498334bd6516bc97f00d80324e
MD5 771152b26aff891eca8cec1e2779e04a
SHA1 c6d67415702bca39019126d96872e07a27f8afba
SHA512 d52289ebc1ccd56485d84971ec4b8a3b22f709886b5fdffe4bcea8b50886517cdbb8681910ce5fc64373e4bde45d83026e6e5bcf4eb49e55c8f963fdb484fe72
SSDEEP 196608:62OV7xf5MqPa9QyS6GBKwophvvi/H7bJR6B3BkamaJU8Al2vw0pETwnrZfVnXGt7:CoqPzfKp6vxR6l6aJYEPTNn2tScT0K
TLSH
T11ED612D526C4927DC4818238E54516F8F0D57CC89CF9842AFFC76A217A71CAAC8B6B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaveUpdate_98faf2910a4c4123bfae349847220646.bat

Path C:\Users\Admin\AppData\Local\Temp\WaveUpdate_98faf2910a4c4123bfae349847220646.bat
Size 672B
SHA256 064267f567b17ddc25d440bd65cf95ca319723cc12f91cdb089f865e28ee9448
MD5 118b5eb1d045423a6bc0df6defc77ea5
SHA1 6cbf2fcdaf203cf970ad85a0104ad0be43337e46
SHA512 c2e934ec16a541f09d255b342f1bad89c8f5bffa8faaa74ff10972aa401223e72babbaf5f735bafba3e323eea588b02bceca9b8ae60d75e337737510b655058a
TLSH
T133012361354A5E9A04214E4F0BAE9718DF6FC48F3F0EA50D59B8854A321E01BBAAC9C2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/704-7-0x00007FFAA69F0000-0x00007FFAA6AC6000-memory.dmp

Download

memory/704-20-0x00007FFAA65A0000-0x00007FFAA65FD000-memory.dmp

Download

memory/704-18-0x00007FFAA7720000-0x00007FFAA7879000-memory.dmp

Download

memory/704-17-0x00007FFAA79F0000-0x00007FFAA7AC3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads