0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198

Resubmissions

11/11/2026, 07:34

261111-jelcsaff2310

10/11/2026, 14:01

261110-rbw9wayt9j10

Analysis

max time kernel
96s
max time network
79s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
11/11/2026, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
signed drivers/0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198.sys
Size 16KB
Sample261111-jelcsaff23
SHA256 0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198
MD5 cc1db5360109de3b857654297d262ca1
SHA1 758240613c362bb1fd13e07d3d19f357b7f8a6da
SHA512 63492d7be766606e3102f6444d94676a068378d7cf85d5bec27062f5fb9cc99bc8a34ee32d173b5a392d4773464327296985a0a7fc1fe27cdd8e060278f4ec28
SSDEEP 384:MYJsx/EzZYCb6NdEVAFba2iWs7pyWy0YJLWd6jqdybm:MYSx/ElbAdbY7p+ZLAmIybm
TLSH
T17D72F69637911034ECD72BB0889EF623B739F2821FA156C7216946CE6C427E17F3964E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1368	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\signed drivers\0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198.sys"
1⤵
- Executes a command shell one-liner
PID:1368
- C:\Users\Admin\AppData\Local\Temp\signed drivers\0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198.sys
  "C:\Users\Admin\AppData\Local\Temp\signed drivers\0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198.sys"
  2⤵
  PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3876-0-0x0000000000010000-0x0000000000012980-memory.dmp

Download