Analysis
- user interaction
yes - max time kernel
38s - max time network
38s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/09/2026, 22:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
KedusWareLoader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target KedusWareLoader.exe
- Size 1.1MB
- Sample260919-2mrtmsfr51
- SHA256 88c722c2a7072720ab1b0b68dde9e500b047d38b491a7b3c09bff9fb687ffb38
- MD5 5b271844b22691784733f98a95bb84ab
- SHA1 d97acadfdcc0e955738bf1320fce1417fb812d61
- SHA512 2f15cf52fe54d5eb78f1519ef9640f222e47ab7194e229361b7d05f1833dc5692e33480f2345f391b66e26a074fe6caa78258105ac7c01f3e0e74796dcfb9542
- SSDEEP 24576:F3QBiuIyKjFV3AWA+gr730eGA+YFimnetyTE5WNPYIim:pQBiuurtBgnHGNmnlYIi
- TLSH T16435AE45B3F401E8E1779178C9B1A61BDA327C5517308ADF07D0166D6F73AE08BBAB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3348 bmptcxco.exe - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3524 KedusWareLoader.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe 3348 bmptcxco.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3348 bmptcxco.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3348 bmptcxco.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3524 wrote to memory of 3348 3524 KedusWareLoader.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\KedusWareLoader.exe"C:\Users\Admin\AppData\Local\Temp\KedusWareLoader.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\bmptcxco.exe"C:\Users\Admin\AppData\Local\Temp\\bmptcxco.exe" --stealth-child2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3348
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\bmptcxco.exe
- Size 1.1MB
- SHA256 88c722c2a7072720ab1b0b68dde9e500b047d38b491a7b3c09bff9fb687ffb38
- MD5 5b271844b22691784733f98a95bb84ab
- SHA1 d97acadfdcc0e955738bf1320fce1417fb812d61
- SHA512 2f15cf52fe54d5eb78f1519ef9640f222e47ab7194e229361b7d05f1833dc5692e33480f2345f391b66e26a074fe6caa78258105ac7c01f3e0e74796dcfb9542
- SSDEEP 24576:F3QBiuIyKjFV3AWA+gr730eGA+YFimnetyTE5WNPYIim:pQBiuurtBgnHGNmnlYIi
- TLSH T16435AE45B3F401E8E1779178C9B1A61BDA327C5517308ADF07D0166D6F73AE08BBAB22
- MD5 SHA1 SHA512 SSDEEP TLSH