ed3c8c0cc58111b40f77e534fb63926a7c79e5846e192971f06989b8abe7506e

Analysis

user interaction
yes
max time kernel
34s
max time network
23s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Strings.Cleaner.exe
Size 263KB
Sample260824-wtly3sbj2w
SHA256 ed3c8c0cc58111b40f77e534fb63926a7c79e5846e192971f06989b8abe7506e
MD5 218fb40cfdd12c7df1d6c79a8c5a583f
SHA1 5cfcbf6e4f39baa2032385ac2c04feb59020a454
SHA512 10ff0aa3d06d44508211ebe0b7288f796a4db4d3a89f927439857b2fbdc3b36e85bbfe25608b302a71c0a05fb6736c414ce0816ac8bb0e6a330559625ca8ff46
SSDEEP 3072:nP+QfNwV5FsDjMa27wqr2ZKU9JFFy68ogBE1W4cNNATIf7CHiX5Gzzo43zZ1AHeL:nPjfmsDox7DIFFy68ogOelJ4zoe
TLSH
T1F2446C16B7A40CFDEDB7853DC9424905DA72BC5647A1E6CF03A04AA70F276D09E3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	5796	Strings.Cleaner.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\RTCore64.sys	Strings.Cleaner.exe
File created	C:\Windows\PPLcontrol.exe	Strings.Cleaner.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1960	cmd.exe
4320	cmd.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5796	Strings.Cleaner.exe
Token: SeBackupPrivilege	5796	Strings.Cleaner.exe
Token: SeRestorePrivilege	5796	Strings.Cleaner.exe
Token: SeTakeOwnershipPrivilege	5796	Strings.Cleaner.exe
Token: SeSecurityPrivilege	5796	Strings.Cleaner.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 1960	5796	Strings.Cleaner.exe	90
PID 5796 wrote to memory of 4320	5796	Strings.Cleaner.exe	91

C:\Users\Admin\AppData\Local\Temp\Strings.Cleaner.exe
"C:\Users\Admin\AppData\Local\Temp\Strings.Cleaner.exe"
1⤵
- Downloads MZ/PE file
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads