81643e2e72342c5fb9fcfb26a0e61c944b22b2496d3c2416f63478849d052c2b

Analysis

user interaction
yes
max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 20:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sina Free.exe
Size 14.4MB
Sample260901-y13lhs1thy
SHA256 81643e2e72342c5fb9fcfb26a0e61c944b22b2496d3c2416f63478849d052c2b
MD5 995fc119d723d739d207c647d1975789
SHA1 95ebbd065a0c91fa49238e6fb7eaa0b2dda5e78a
SHA512 454e487a0900c03a396b25395c21c13f835d806f6cd59485ee0c6180be2baeb5e5da2bd147b5e48898f582e4a73dffa09b3f74accd38546bde0d9e1264948431
SSDEEP 393216:NM8+GHwInWsw/h/5IH44Of37HRJy9Hgq2v:NZH1hw/h/yH4427xJy9Hg
TLSH
T19FE623D73EC99678D0C7CF30A28E0B5971D1B7C89AB76A1D37C21C06E530E978A85927
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion execution

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
720	Sina Free.exe
720	Sina Free.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4516	cmd.exe
3344	cmd.exe
5392	cmd.exe
4280	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4832	timeout.exe
4428	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
720	Sina Free.exe
720	Sina Free.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
720	Sina Free.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 3344	720	Sina Free.exe	90
PID 3344 wrote to memory of 5392	3344	cmd.exe	92
PID 5392 wrote to memory of 4832	5392	cmd.exe	96
PID 720 wrote to memory of 4280	720	Sina Free.exe	98
PID 4280 wrote to memory of 4516	4280	cmd.exe	100
PID 4516 wrote to memory of 4428	4516	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\Sina Free.exe
"C:\Users\Admin\AppData\Local\Temp\Sina Free.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5392
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo CURL Error: Failure when receiving data from the peer && timeout /t 5"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo CURL Error: Failure when receiving data from the peer && timeout /t 5"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4516
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/720-0-0x00007FF6742D4000-0x00007FF674A52000-memory.dmp

Download

memory/720-1-0x00007FFD5BDF0000-0x00007FFD5BDF2000-memory.dmp

Download

memory/720-2-0x00007FFD5BE00000-0x00007FFD5BE02000-memory.dmp

Download

memory/720-3-0x00007FF674000000-0x00007FF6758B6000-memory.dmp

Download

memory/720-10-0x0000024AAE2A0000-0x0000024AAE2A1000-memory.dmp

Download

memory/720-8-0x0000024AAE2A0000-0x0000024AAE2A1000-memory.dmp

Download

memory/720-11-0x00007FF6742D4000-0x00007FF674A52000-memory.dmp

Download

memory/720-12-0x00007FF674000000-0x00007FF6758B6000-memory.dmp

Download

memory/720-13-0x00007FF674000000-0x00007FF6758B6000-memory.dmp

Download