e6f9b4b0a36aae66bc6c811bf6aae96234e07049a55ebde56388a56d85438ee6

Resubmissions

19/08/2026, 01:38

260819-b2dbpathpf8

19/08/2026, 01:37

260819-b1z43athnf3

19/08/2026, 01:34

260819-bzh46abr7w8

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
46s
max time network
26s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef1a5648-e327-424c-8e8a-db9d2c790b30.XrAydmny.exe
Size 880KB
Sample260819-b2dbpathpf
SHA256 e6f9b4b0a36aae66bc6c811bf6aae96234e07049a55ebde56388a56d85438ee6
MD5 84223dd5145a488fbc17614778b9be1f
SHA1 6ff8c7734e9fbae538ffe88a7de20fce82913f67
SHA512 9aa43ddc470e36a1d44cb30c77c2d599a2bf43a76b1caf2050ecf9f5e240cc251ce0933dba7b3315c04230db0e7a23b8cddd2431fb0b5cfe488be643c4fb8728
SSDEEP 24576:gk7/BNGayaSoZn5MgwsQd9uSlYB8iWnttpIdh+YW2K:gk7jZyaSo1dVmV65Wn7pEh+z2K
TLSH
T18115AE08FAF145A8C17B647994A6A31BF736B84C1B7086E763E801983FA33E44F75712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2296	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5996 wrote to memory of 2296	5996	ef1a5648-e327-424c-8e8a-db9d2c790b30.XrAydmny.exe	90

C:\Users\Admin\AppData\Local\Temp\ef1a5648-e327-424c-8e8a-db9d2c790b30.XrAydmny.exe
"C:\Users\Admin\AppData\Local\Temp\ef1a5648-e327-424c-8e8a-db9d2c790b30.XrAydmny.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads