ae51e0eb0aa1079f4b8c3904cf6076ea338ada1a82f9c5b228f73dc06951f5d0

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ledger Live Beta.exe
Size 54.2MB
Sample260820-ef2nyabc68
SHA256 ae51e0eb0aa1079f4b8c3904cf6076ea338ada1a82f9c5b228f73dc06951f5d0
MD5 9026b4f210d8090618019ed2366863e3
SHA1 fabf0b2c73b25daf5c285a460bf1f41d34470ee3
SHA512 014f52718930b729eca426c8d14d180df648efc4b07d98195368ac1ef76786a13ce380f8eb301b87127e8f5513ef7344dcf343a752e3a8c6cc5b16b0b83a1b0c
SSDEEP 393216:fR9rrXTRddSenbJGSLxDPcHGYjx9oKlQnAliXUxR0rHa93WhlU6tTsRQaoqk8BbF:fTjTdSUxGHrxdwiHFk8BbF
TLSH
T143C76C03BA9B18DAD0AAC870C3D646638A617CC71B35B5EF51C52B252F7ABF05B39314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
1	raw.githubusercontent.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
708	powershell.exe
4388	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4756	Ledger Live Beta.exe
4756	Ledger Live Beta.exe
4752	powershell.exe
4752	powershell.exe
708	powershell.exe
708	powershell.exe
4388	powershell.exe
4388	powershell.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	708	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeIncreaseQuotaPrivilege	4388	powershell.exe
Token: SeSecurityPrivilege	4388	powershell.exe
Token: SeTakeOwnershipPrivilege	4388	powershell.exe
Token: SeLoadDriverPrivilege	4388	powershell.exe
Token: SeSystemProfilePrivilege	4388	powershell.exe
Token: SeSystemtimePrivilege	4388	powershell.exe
Token: SeProfSingleProcessPrivilege	4388	powershell.exe
Token: SeIncBasePriorityPrivilege	4388	powershell.exe
Token: SeCreatePagefilePrivilege	4388	powershell.exe
Token: SeBackupPrivilege	4388	powershell.exe
Token: SeRestorePrivilege	4388	powershell.exe
Token: SeShutdownPrivilege	4388	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeSystemEnvironmentPrivilege	4388	powershell.exe
Token: SeRemoteShutdownPrivilege	4388	powershell.exe
Token: SeUndockPrivilege	4388	powershell.exe
Token: SeManageVolumePrivilege	4388	powershell.exe
Token: 33	4388	powershell.exe
Token: 34	4388	powershell.exe
Token: 35	4388	powershell.exe
Token: 36	4388	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4752	4756	Ledger Live Beta.exe	90
PID 4752 wrote to memory of 1652	4752	powershell.exe	91
PID 1652 wrote to memory of 4228	1652	csc.exe	92
PID 4756 wrote to memory of 708	4756	Ledger Live Beta.exe	93
PID 4756 wrote to memory of 4388	4756	Ledger Live Beta.exe	94
PID 4756 wrote to memory of 5972	4756	Ledger Live Beta.exe	96

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5972	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Ledger Live Beta.exe
"C:\Users\Admin\AppData\Local\Temp\Ledger Live Beta.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgBpAGYAIAAoAC0AbgBvAHQAIAAoAFsAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAFAAUwBUAHkAcABlAE4AYQBtAGUAXQAnAFcAaQBuADMAMgAnACkALgBUAHkAcABlACkAIAB7AAoAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIABAACIACgAgACAAIAAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsACgAgACAAIAAgAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsACgAKACAAIAAgACAAcAB1AGIAbABpAGMAIABjAGwAYQBzAHMAIABXAGkAbgAzADIAIAB7AAoAIAAgACAAIAAgACAAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAIAAgACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABHAGUAdABGAG8AcgBlAGcAcgBvAHUAbgBkAFcAaQBuAGQAbwB3ACgAKQA7AAoACgAgACAAIAAgACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABbAHIAZQB0AHUAcgBuADoAIABNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBCAG8AbwBsACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AbwBsACAAUwBoAG8AdwBXAGkAbgBkAG8AdwAoAEkAbgB0AFAAdAByACAAaABXAG4AZAAsACAAaQBuAHQAIABuAEMAbQBkAFMAaABvAHcAKQA7AAoAIAAgACAAIAB9AAoAIgBAAAoAfQAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AEEAYwB0AGkAdgBlAFcAaQBuAGQAbwB3AFQAaQB0AGwAZQAoACkAIAB7AAoAIAAgACAAIAAkAGgAVwBuAGQAIAA9ACAAWwBXAGkAbgAzADIAXQA6ADoARwBlAHQARgBvAHIAZQBnAHIAbwB1AG4AZABXAGkAbgBkAG8AdwAoACkACgAgACAAIAAgACQAcwBiACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByACgAMgA1ADYAKQAKACAAIAAgACAAWwBXAGkAbgAzADIAXQA6ADoARwBlAHQAVwBpAG4AZABvAHcAVABlAHgAdAAoACQAaABXAG4AZAAsACAAJABzAGIALAAgACQAcwBiAC4AQwBhAHAAYQBjAGkAdAB5ACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcwBiAC4AVABvAFMAdAByAGkAbgBnACgAKQAKAH0ACgBmAHUAbgBjAHQAaQBvAG4AIABIAGkAZABlAEEAYwB0AGkAdgBlAFcAaQBuAGQAbwB3ACgAKQAgAHsACgAgACAAIAAgACQAaABXAG4AZAAgAD0AIABbAFcAaQBuADMAMgBdADoAOgBHAGUAdABGAG8AcgBlAGcAcgBvAHUAbgBkAFcAaQBuAGQAbwB3ACgAKQAKACAAIAAgACAAWwBXAGkAbgAzADIAXQA6ADoAUwBoAG8AdwBXAGkAbgBkAG8AdwAoACQAaABXAG4AZAAsACAAMAApAAoAfQAKACQAYwB1AHIAcgBlAG4AdABXAGkAbgBkAG8AdwBUAGkAdABsAGUAIAA9ACAARwBlAHQAQQBjAHQAaQB2AGUAVwBpAG4AZABvAHcAVABpAHQAbABlAAoASABpAGQAZQBBAGMAdABpAHYAZQBXAGkAbgBkAG8AdwAKAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5rrak1nc\5rrak1nc.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4F4F.tmp" "c:\Users\Admin\AppData\Local\Temp\5rrak1nc\CSC2E1D757564B54A01A2CB4E4995BE67F3.TMP"
      4⤵
      PID:4228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoLogo -NonInteractive -Command "(Get-CimInstance -ClassName Win32_ComputerSystemProduct).UUID"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- C:\Windows\SYSTEM32\attrib.exe
  "attrib" +h C:\WindowsGraphics
  2⤵
  - Views/modifies file attributes
  PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3674b90c1caf1df47ef6cdfcff99b7987586cab16fe77bbe8318ca09a0cd9a77
MD5 8e905f2b8648d1e6d98fe873e767284e
SHA1 b351c01a95e361a8200fad41aaeb7eda7cd56d00
SHA512 651c9b32840f7670a5ab155e3a89147921c73c323076c72fa39573f6ab7c4a96a64a70cd8078822c004e1842515414c2eba88a034eceff86fab746e992d6fc90
TLSH
T160215733F3CC8624DC9A403650CEAC1136B687DB409EDE6BBB84D549B42F289DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

5rrak1nc.dll

Path C:\Users\Admin\AppData\Local\Temp\5rrak1nc\5rrak1nc.dll
Size 3KB
SHA256 838f986330164667ab893d0c15ee234030910f1376a7bcce8f0768c42a1393f7
MD5 9e6e6b162cef9c844bcad66fc9857c57
SHA1 7536c7faa75b753dc6bcaa420df09aa710dd5e29
SHA512 b22af420bdba427620fbd16538988edba19f2c637aa6f645a845a4d921d296eef04854b5fa947f1e065b78c816b9fd2166a3ff318b8b47243dd9baf80cfea759
TLSH
T18451CB0693E8462BF8B70738AEE3532637A8FD509F73575E09804229EC616644E72BB5
MD5 SHA1 SHA512 TLSH

Submit Download

RES4F4F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4F4F.tmp
Size 1KB
SHA256 662bc52f94524723cb1518df1d7dfb334e56d1f65ed9fb5cc1b670ab527170df
MD5 00a791cf199be992584fc38779865d01
SHA1 2c6463ab7f81a80c5e53f35e6eb91428f62bd11d
SHA512 b847f6b2ac37072a853a84a2cbca7c982c52c4c76cddc5aef42c48e0c69bb8a124312ba351b6b7ec9ef4c9cba2321ee4d4b2267ec259f6f925011b610f6c43e9
TLSH
T11221EF0543E8871EF0B34731A9F6276FA274FD54EF62635B454042292C51140EFE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vdqstmtj.pki.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vdqstmtj.pki.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

5rrak1nc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5rrak1nc\5rrak1nc.0.cs
Size 343B
SHA256 abbbedac28650c7d19e51f587149e89a44a01c925ea1a496f0f1bcf6288f98f1
MD5 c36def33cf3b17c9e92da3e1e7781022
SHA1 58ca5035b92f51d361e3b536bb1478285aabb3b2
SHA512 4285621a8df007a5f95f7582795035495dcd315b50776fadcf8d9d5755efacfd7e4da46260f2418ad5453a2704aaed565d9fb85ab5f83259dc7302852f38daf6
TLSH
T1D3E07D547713AD601013440B1D83E5FDB22700337A6E1900B6BD0331DF4F019D170B5C
MD5 SHA1 SHA512 TLSH

Submit Download

5rrak1nc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5rrak1nc\5rrak1nc.cmdline
Size 369B
SHA256 e6f9b501c91a9a795f11e0e17c889c7883736c9c125a91297964b1a40836d4ec
MD5 ca5bdb14a06c253a9bc1478da071cb53
SHA1 6c4930059be46c0cbc53522daa21ac994900633a
SHA512 68d39c647be09df8ba786352bde6637ae744f9985841c48b69f9b128638dfd170a3fa8875ef90a68fee576f982f738c20aea90b340f4be609d05e68dd298d622
TLSH
T149E06F2B6287C27D01EA100B227AE4BE8AB2068329803F869080880DE0374002BD2781
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2E1D757564B54A01A2CB4E4995BE67F3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5rrak1nc\CSC2E1D757564B54A01A2CB4E4995BE67F3.TMP
Size 652B
SHA256 a46a4f2a9e519c77b8aa30ff8c5cb8d679289487bc4b66361dbba1b42c5b9627
MD5 2885d9c23654f4df5f9e9501b759c609
SHA1 b9a79c9c0a684bddc6a5b9d45930adc11998a6d0
SHA512 5de3b87317f14ef987b6d26597b59c09f7d16e385fa510a8965dc99d4dcf060d074650fcae96ee1dcd2724d3c97657e4156baa79cc5988b91bd27ce3c58f4741
TLSH
T13AF0540963F8120EF4F34B71BEF543A3A568BC64DE3353ED1940031918745108961F75
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4388-35-0x000002D73BFC0000-0x000002D73BFDE000-memory.dmp

Download

memory/4388-36-0x000002D73BFE0000-0x000002D73C092000-memory.dmp

Download

memory/4388-39-0x000002D73C450000-0x000002D73C474000-memory.dmp

Download

memory/4388-38-0x000002D73C450000-0x000002D73C47A000-memory.dmp

Download

memory/4388-37-0x000002D73C0A0000-0x000002D73C0AA000-memory.dmp

Download

memory/4752-5-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4752-25-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4752-21-0x000001E678E40000-0x000001E678E48000-memory.dmp

Download

memory/4752-7-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4752-4-0x000001E678D90000-0x000001E678DB2000-memory.dmp

Download

memory/4752-6-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4752-23-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4752-22-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4752-13-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4752-1-0x00007FF8489FF000-0x00007FF848A00000-memory.dmp

Download