467682cdb5fa482c54897c6b9c96a5300a3516a72ef70ec3d009e16fadb131b3

Analysis

max time kernel
151s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
herdr.exe
Size 21.4MB
Sample260824-gzjnkstdnc
SHA256 467682cdb5fa482c54897c6b9c96a5300a3516a72ef70ec3d009e16fadb131b3
MD5 95f133e2413a2a91c71d3bfd67e3f56e
SHA1 0c2dc0d4e67b828ddd28c9cadaf6cc6d5aa971e1
SHA512 8cbe8476f55da1c2f18ba8dba09d6ce7c1823a3e0c2cb86ff1a1d92fe7d42af022e10e6e003a97ebd083d699d684415ba422c8bfd1c0db83547fd1e89fdd16c9
SSDEEP 196608:xswsCu2YBpwesfkCW5Ls+yYF8Zz6GE8Ch:ueu2YBEVW5Ls+JAS8
TLSH
T19A37F711BB8ED95CD15BC8B0834A4B324A3530DB1A35BABF60DC55753FEFAB41A28718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4748	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4748	powershell.exe
4748	powershell.exe
4748	powershell.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe
6072	herdr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4748	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 6072	1952	herdr.exe	90
PID 6072 wrote to memory of 4728	6072	herdr.exe	91
PID 6072 wrote to memory of 5820	6072	herdr.exe	92
PID 6072 wrote to memory of 1132	6072	herdr.exe	95
PID 6072 wrote to memory of 4748	6072	herdr.exe	96
PID 6072 wrote to memory of 3708	6072	herdr.exe	98
PID 6072 wrote to memory of 4580	6072	herdr.exe	100
PID 6072 wrote to memory of 5092	6072	herdr.exe	102
PID 6072 wrote to memory of 3152	6072	herdr.exe	104
PID 6072 wrote to memory of 4712	6072	herdr.exe	106
PID 6072 wrote to memory of 5420	6072	herdr.exe	108
PID 6072 wrote to memory of 4576	6072	herdr.exe	110
PID 6072 wrote to memory of 6012	6072	herdr.exe	112
PID 6072 wrote to memory of 4668	6072	herdr.exe	114
PID 6072 wrote to memory of 3076	6072	herdr.exe	116
PID 6072 wrote to memory of 4776	6072	herdr.exe	118
PID 6072 wrote to memory of 4080	6072	herdr.exe	120
PID 6072 wrote to memory of 4208	6072	herdr.exe	122
PID 6072 wrote to memory of 5624	6072	herdr.exe	124
PID 6072 wrote to memory of 1996	6072	herdr.exe	126
PID 6072 wrote to memory of 4420	6072	herdr.exe	128
PID 6072 wrote to memory of 5908	6072	herdr.exe	130
PID 6072 wrote to memory of 2520	6072	herdr.exe	132
PID 6072 wrote to memory of 1596	6072	herdr.exe	134
PID 6072 wrote to memory of 5016	6072	herdr.exe	136

cURL User-Agent 22 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	56	curl/8.8.0
HTTP User-Agent header	21	curl/8.8.0
HTTP User-Agent header	30	curl/8.8.0
HTTP User-Agent header	53	curl/8.8.0
HTTP User-Agent header	20	curl/8.8.0
HTTP User-Agent header	27	curl/8.8.0
HTTP User-Agent header	39	curl/8.8.0
HTTP User-Agent header	58	curl/8.8.0
HTTP User-Agent header	60	curl/8.8.0
HTTP User-Agent header	62	curl/8.8.0
HTTP User-Agent header	63	curl/8.8.0
HTTP User-Agent header	37	curl/8.8.0
HTTP User-Agent header	48	curl/8.8.0
HTTP User-Agent header	67	curl/8.8.0
HTTP User-Agent header	68	curl/8.8.0
HTTP User-Agent header	71	curl/8.8.0
HTTP User-Agent header	40	curl/8.8.0
HTTP User-Agent header	16	curl/8.8.0
HTTP User-Agent header	17	curl/8.8.0
HTTP User-Agent header	18	curl/8.8.0
HTTP User-Agent header	19	curl/8.8.0
HTTP User-Agent header	33	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\herdr.exe
"C:\Users\Admin\AppData\Local\Temp\herdr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Temp\herdr.exe
  "C:\Users\Admin\AppData\Local\Temp\herdr.exe" server
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6072
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 3 --connect-timeout 10 --max-time 20 https://herdr.dev/latest.json
    3⤵
    PID:4728
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/index.toml
    3⤵
    PID:5820
- - C:\Users\Admin\AppData\Local\Temp\conpty\x64\OpenConsole.exe
    "C:\Users\Admin\AppData\Local\Temp\conpty\x64\OpenConsole.exe" --headless --inheritcursor --width 120 --height 40 --signal 0x248 --server 0x23c
    3⤵
    PID:1132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoExit -Command "if ($null -eq $global:__HerdrOriginalPrompt) { $global:__HerdrOriginalPrompt = $function:prompt; function global:prompt { $out = @(& $global:__HerdrOriginalPrompt) -join ' '; $loc = $ExecutionContext.SessionState.Path.CurrentLocation; if ($loc.Provider.Name -eq 'FileSystem') { try { [Environment]::CurrentDirectory = $loc.ProviderPath } catch {}; $esc = [string][char]27; $out += $esc + ']9;9;' + $loc.ProviderPath + $esc + '\' }; $out } }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/amp.toml
    3⤵
    PID:3708
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/antigravity.toml
    3⤵
    PID:4580
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/claude.toml
    3⤵
    PID:5092
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/cline.toml
    3⤵
    PID:3152
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/codex.toml
    3⤵
    PID:4712
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/cursor.toml
    3⤵
    PID:5420
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/devin.toml
    3⤵
    PID:4576
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/droid.toml
    3⤵
    PID:6012
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/gemini.toml
    3⤵
    PID:4668
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/grok.toml
    3⤵
    PID:3076
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/hermes.toml
    3⤵
    PID:4776
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/kilo.toml
    3⤵
    PID:4080
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/kimi.toml
    3⤵
    PID:4208
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/kiro.toml
    3⤵
    PID:5624
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/maki.toml
    3⤵
    PID:1996
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/opencode.toml
    3⤵
    PID:4420
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/pi.toml
    3⤵
    PID:5908
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/qodercli.toml
    3⤵
    PID:2520
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/qwen.toml
    3⤵
    PID:1596
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/github-copilot.toml
    3⤵
    PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

herdr-client.sock

Path C:\Users\Admin\AppData\Roaming\herdr\herdr-client.sock
Size 24B
SHA256 ba63bfef037e89f52b48064907d507f6adbb97039de68a58691729324cff9826
MD5 9c0d65d9c16955ea615e749fc37e4b56
SHA1 2de4781f250ee8245568f3f8821f23f29ec2d300
SHA512 deddfcb2d8ba9f0cd773f583aa4c04fa7136f7198a98b5eebdb608a60b7b41c53c22f2d9fc325925783c8edbd6cedec530baa1c9f64d38318a1f16874a39dfc5
MD5 SHA1 SHA512

Submit Download

memory/4748-10-0x0000015DC1AB0000-0x0000015DC1AD2000-memory.dmp

Download

memory/4748-11-0x0000015DDA380000-0x0000015DDA3C8000-memory.dmp

Download