ad68be0180565fe6f0cd7873cd1619bd5cac1111d9503d844bf62e56b2236313

Analysis

max time kernel
141s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
get-with-aria2.cmd
Size 1KB
Sample261030-ltakyays4j
SHA256 ad68be0180565fe6f0cd7873cd1619bd5cac1111d9503d844bf62e56b2236313
MD5 eca94b1e8abf2177524287fd1f5958dc
SHA1 3825efae067cf401bd314bbafcf4fde264331d2f
SHA512 44c203a8374029f23d5a79ec60ae4dfe400fb63be44bb1c63a6a432282a999f32ce244c7f8e2906fb590e1d389bc7e6b1b55a8c143746a1cfac8172c0111088d
TLSH
T1A64133CF7F064676733D16A07E2A0582715A82EB16135D9C70F30C99D09C9617AD9349
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5112	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3328	5112	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\get-with-aria2.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\bin\aria2c.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\aria2c.exe" --input-file="C:\Users\Admin\AppData\Local\Temp\uup_parts_904432302\parts.txt" --dir="." --auto-file-renaming=false --allow-overwrite=true --continue=true --max-concurrent-downloads=16 --split=16 --min-split-size=1M --check-integrity=true --console-log-level=warn --summary-interval=30 --file-allocation=none
  2⤵
  PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

parts.txt

Path C:\Users\Admin\AppData\Local\Temp\uup_parts_904432302\parts.txt
Size 560B
SHA256 dba829ae957c61364edfd669175d9a22ad4290e2486472fe081e9d1136c97083
MD5 d891c792d8b7a8f787bf7dd8e73e1fd7
SHA1 cfa771ea624e8d58f0bf0b927ec0c39008f42d4b
SHA512 5fabf60136ee6ccf8c76e8140cdc74fa455e81fb7cf9b40eceece1e2f0f811c4155e11c813cf3f4028e6204114537dec16ad76a9dd8a85bf92de1efe856e39cb
TLSH
T1D3F022D3EB0A9858732A1582FD6B1DA12AA3827FC50280A840F20DDEC2F8973234734C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3328-8-0x00007FF63F990000-0x00007FF63FEFD000-memory.dmp

Download

memory/3328-10-0x00007FF63F990000-0x00007FF63FEFD000-memory.dmp