ae51e0eb0aa1079f4b8c3904cf6076ea338ada1a82f9c5b228f73dc06951f5d0

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ledger Live Beta.exe
Size 54.2MB
Sample260820-ef2nyabc68
SHA256 ae51e0eb0aa1079f4b8c3904cf6076ea338ada1a82f9c5b228f73dc06951f5d0
MD5 9026b4f210d8090618019ed2366863e3
SHA1 fabf0b2c73b25daf5c285a460bf1f41d34470ee3
SHA512 014f52718930b729eca426c8d14d180df648efc4b07d98195368ac1ef76786a13ce380f8eb301b87127e8f5513ef7344dcf343a752e3a8c6cc5b16b0b83a1b0c
SSDEEP 393216:fR9rrXTRddSenbJGSLxDPcHGYjx9oKlQnAliXUxR0rHa93WhlU6tTsRQaoqk8BbF:fTjTdSUxGHrxdwiHFk8BbF
TLSH
T143C76C03BA9B18DAD0AAC870C3D646638A617CC71B35B5EF51C52B252F7ABF05B39314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4116	powershell.exe
4892	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3412	Ledger Live Beta.exe
3412	Ledger Live Beta.exe
2984	powershell.exe
2984	powershell.exe
4116	powershell.exe
4116	powershell.exe
4892	powershell.exe
4892	powershell.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeIncreaseQuotaPrivilege	4892	powershell.exe
Token: SeSecurityPrivilege	4892	powershell.exe
Token: SeTakeOwnershipPrivilege	4892	powershell.exe
Token: SeLoadDriverPrivilege	4892	powershell.exe
Token: SeSystemProfilePrivilege	4892	powershell.exe
Token: SeSystemtimePrivilege	4892	powershell.exe
Token: SeProfSingleProcessPrivilege	4892	powershell.exe
Token: SeIncBasePriorityPrivilege	4892	powershell.exe
Token: SeCreatePagefilePrivilege	4892	powershell.exe
Token: SeBackupPrivilege	4892	powershell.exe
Token: SeRestorePrivilege	4892	powershell.exe
Token: SeShutdownPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeSystemEnvironmentPrivilege	4892	powershell.exe
Token: SeRemoteShutdownPrivilege	4892	powershell.exe
Token: SeUndockPrivilege	4892	powershell.exe
Token: SeManageVolumePrivilege	4892	powershell.exe
Token: 33	4892	powershell.exe
Token: 34	4892	powershell.exe
Token: 35	4892	powershell.exe
Token: 36	4892	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 2984	3412	Ledger Live Beta.exe	86
PID 2984 wrote to memory of 4720	2984	powershell.exe	87
PID 4720 wrote to memory of 2156	4720	csc.exe	88
PID 3412 wrote to memory of 4116	3412	Ledger Live Beta.exe	89
PID 3412 wrote to memory of 4892	3412	Ledger Live Beta.exe	90
PID 3412 wrote to memory of 2824	3412	Ledger Live Beta.exe	92

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2824	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Ledger Live Beta.exe
"C:\Users\Admin\AppData\Local\Temp\Ledger Live Beta.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgBpAGYAIAAoAC0AbgBvAHQAIAAoAFsAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAFAAUwBUAHkAcABlAE4AYQBtAGUAXQAnAFcAaQBuADMAMgAnACkALgBUAHkAcABlACkAIAB7AAoAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIABAACIACgAgACAAIAAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsACgAgACAAIAAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsACgAKACAAIAAgACAAcAB1AGIAbABpAGMAIABjAGwAYQBzAHMAIABXAGkAbgAzADIAIAB7AAoAIAAgACAAIAAgACAAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAIAAgACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABHAGUAdABGAG8AcgBlAGcAcgBvAHUAbgBkAFcAaQBuAGQAbwB3ACgAKQA7AAoACgAgACAAIAAgACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABbAHIAZQB0AHUAcgBuADoAIABNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBCAG8AbwBsACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAUwBoAG8AdwBXAGkAbgBkAG8AdwAoAEkAbgB0AFAAdAByACAAaABXAG4AZAAsACAAaQBuAHQAIABuAEMAbQBkAFMAaABvAHcAKQA7AAoAIAAgACAAIAB9AAoAIgBAAAoAfQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AEEAYwB0AGkAdgBlAFcAaQBuAGQAbwB3AFQAaQB0AGwAZQAoACkAIAB7AAoAIAAgACAAIAAkAGgAVwBuAGQAIAA9ACAAWwBXAGkAbgAzADIAXQA6ADoARwBlAHQARgBvAHIAZQBnAHIAbwB1AG4AZABXAGkAbgBkAG8AdwAoACkACgAgACAAIAAgACQAcwBiACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByACgAMgA1ADYAKQAKACAAIAAgACAAWwBXAGkAbgAzADIAXQA6ADoARwBlAHQAVwBpAG4AZABvAHcAVABlAHgAdAAoACQAaABXAG4AZAAsACAAJABzAGIALAAgACQAcwBiAC4AQwBhAHAAYQBjAGkAdAB5ACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcwBiAC4AVABvAFMAdAByAGkAbgBnACgAKQAKAH0ACgBmAHUAbgBjAHQAaQBvAG4AIABIAGkAZABlAEEAYwB0AGkAdgBlAFcAaQBuAGQAbwB3ACgAKQAgAHsACgAgACAAIAAgACQAaABXAG4AZAAgAD0AIABbAFcAaQBuADMAMgBdADoAOgBHAGUAdABGAG8AcgBlAGcAcgBvAHUAbgBkAFcAaQBuAGQAbwB3ACgAKQAKACAAIAAgACAAWwBXAGkAbgAzADIAXQA6ADoAUwBoAG8AdwBXAGkAbgBkAG8AdwAoACQAaABXAG4AZAAsACAAMAApAAoAfQAKACQAYwB1AHIAcgBlAG4AdABXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAA9ACAARwBlAHQAQQBjAHQAaQB2AGUAVwBpAG4AZABvAHcAVABpAHQAbABlAAoASABpAGQAZQBBAGMAdABpAHYAZQBXAGkAbgBkAG8AdwAKAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cw4lo4cl\cw4lo4cl.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA26.tmp" "c:\Users\Admin\AppData\Local\Temp\cw4lo4cl\CSC2A8F886335E04F96BDFDA9EFF4AD14A.TMP"
      4⤵
      PID:2156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoLogo -NonInteractive -Command "(Get-CimInstance -ClassName Win32_ComputerSystemProduct).UUID"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4892
- C:\Windows\SYSTEM32\attrib.exe
  "attrib" +h C:\WindowsGraphics
  2⤵
  - Views/modifies file attributes
  PID:2824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5712e075ba835a40510d658e34443fa6b69563052def7ba21b9a614c9bb8c782
MD5 b8d423e9d0a2e396d7111d1420b65962
SHA1 df4f45a55d1cc8578407231681504cd0d9cf5210
SHA512 ad5a7da77befebc8f8fcbf9d728b498cbe0d9bdb8b2d79346473378adb28a284b84e51e6d8aec75b966ec658b0afdef748b382f1ed1927f4327717cf48d7055c
TLSH
T14F115327B39CC921CC96153A409DAD1172B683DB81AEDE9FABC4D614A07F588CB712A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 5ffd4a816ae5d1c1a8bdc51d2872b7dd99e9c383c88001d303a6f64a77773686
MD5 235a8eb126d835efb2e253459ab8b089
SHA1 293fbf68e6726a5a230c3a42624c01899e35a89f
SHA512 a83d17203b581491e47d65131e1efc8060ff04d1852e3415fc0a341c6a9691ef9f4cf4dd29d2f6d0032a49f2ba4bd36c35b3f472f0ce5f78f4bb139124760e92
MD5 SHA1 SHA512

Submit Download

RESAA26.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAA26.tmp
Size 1KB
SHA256 9818aa770b702a580ed7b9563123a2e2113fd1ff84ec672a9ea60bd28bd186da
MD5 ae83a0a3cec05efc95c18bedc15074ec
SHA1 b62053a58cd0185ab237a8a5fead77d5f83cb1be
SHA512 87602f85d4cc74818f6c0cb19b9ee63b426266d3dcd5bed2446d8f712e614a7acfb93c44b050d63942fd09622584924a894e7af6c601469b1aea9a648e5e4280
TLSH
T1E321A60183F94B0FF07357326EF6032BA238FD64EFA2A39B8800412C1851514EFA0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_j5pmsp25.le4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j5pmsp25.le4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cw4lo4cl.dll

Path C:\Users\Admin\AppData\Local\Temp\cw4lo4cl\cw4lo4cl.dll
Size 3KB
SHA256 e62ca25260071f1d197e89afb029e5678cd335e7c7930059c1a268cee1545053
MD5 e3e87171d4c429d521a7b070a8948e25
SHA1 3982a01e27e44c19a2609bbf50b707e44b238025
SHA512 6692db61c717fdcf9a9572a6866ba29ba3ec1cfa63fcbed19728d40f7b5f0a66b6b0e0155ac9abd11a65a90e856ee97111cefae677d9b99bff3a9471279ad1e1
TLSH
T11251DF0697E84A6BE4774734AEF3432637B4FC209B77975E09804229EC616644E32FF5
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2A8F886335E04F96BDFDA9EFF4AD14A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\cw4lo4cl\CSC2A8F886335E04F96BDFDA9EFF4AD14A.TMP
Size 652B
SHA256 beb52ea900abf270bb9a191f1b59f9dd09f34750b0750a6ac7799b035c8646fb
MD5 995f7dacf8e03d133df6aac5bd2a43aa
SHA1 fb10278195d2f0e1d17aec7eab1eb389ff84bde4
SHA512 dc0a12f722296755a2dd5f257369f85a2f74e16777b9b6761b87e133141d7c7173b64fa19786834ec890ee3b160e02e11a66324048dc8f199c2a4ddeb720c03c
TLSH
T177F0540963F8020EF0F35B30BEF543A39569BC64DE3293ED1840031918649248A61F72
MD5 SHA1 SHA512 TLSH

Submit Download

cw4lo4cl.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\cw4lo4cl\cw4lo4cl.0.cs
Size 343B
SHA256 abbbedac28650c7d19e51f587149e89a44a01c925ea1a496f0f1bcf6288f98f1
MD5 c36def33cf3b17c9e92da3e1e7781022
SHA1 58ca5035b92f51d361e3b536bb1478285aabb3b2
SHA512 4285621a8df007a5f95f7582795035495dcd315b50776fadcf8d9d5755efacfd7e4da46260f2418ad5453a2704aaed565d9fb85ab5f83259dc7302852f38daf6
TLSH
T1D3E07D547713AD601013440B1D83E5FDB22700337A6E1900B6BD0331DF4F019D170B5C
MD5 SHA1 SHA512 TLSH

Submit Download

cw4lo4cl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\cw4lo4cl\cw4lo4cl.cmdline
Size 369B
SHA256 db91613e0205f07b63c7b6ea8df9d75a016fb956695b1f9af27416ed50cfd16b
MD5 c42745a44c27991c8e28578d43572a3c
SHA1 c8cfc0df9dbdf2fcff3f2ff127d9be49545c5669
SHA512 cd9d2c751cc367c5c40999427577a3dfaf9e5707c539a37b31b8ad15a5558c3e8819960cfe618325d6d6e67a131e70d848464f0148af581387db6c5441c2560f
TLSH
T144E0202B5356C67D15FF600B226DC5ACC2B20747298F7F886550D45DD057804ABD27D5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2984-8-0x00000244769F0000-0x0000024476A12000-memory.dmp

Download

memory/2984-23-0x0000024476EB0000-0x0000024476EB8000-memory.dmp

Download

memory/2984-1-0x0000024476130000-0x0000024476140000-memory.dmp

Download

memory/2984-2-0x0000024476130000-0x0000024476140000-memory.dmp

Download

memory/4892-44-0x000001DCFCA00000-0x000001DCFCA2A000-memory.dmp

Download

memory/4892-45-0x000001DCFCA00000-0x000001DCFCA24000-memory.dmp

Download