Analysis
- max time kernel
148s - max time network
151s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20251231-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20251231-enlocale:en-usos:windows10-ltsc_2021-x64system - submitted
12/01/2026, 00:24
Static task
static1
Behavioral task
behavioral1
Sample
Loli.bat
Resource
win10v2004-20251231-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loli.bat
Resource
win10ltsc2021-20251231-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Loli.bat
Resource
win11-20251231-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target Loli.bat
- Size 4.8MB
- Sample260112-ap7jbshs4c
- SHA256 92998568b2f00bf512907123c94562bdac71474e675f8c878044c7fb26cd4dfb
- MD5 22f0e9809da9691208ebff4b54d412f8
- SHA1 d80f15ee71ab187fd4c27abbc666d2eb3a92cb09
- SHA512 a53bfcfaa6505eb39a60a77c48ecdc72a249cd8ab0c55e8a935e1ea95d2b20944eaf1311e91b3d91672fcaf814c6cff040443228297c5c7e2df99fd3230e60fd
- SSDEEP 49152:a1RUIhoN014ZdRV6mMycZyNY1ARMhVYuKrfQOJ/21RtSQfIvhSgeOQ:y
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4676 WMIC.exe 4676 WMIC.exe 4676 WMIC.exe 4676 WMIC.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4676 WMIC.exe Token: SeSecurityPrivilege 4676 WMIC.exe Token: SeTakeOwnershipPrivilege 4676 WMIC.exe Token: SeLoadDriverPrivilege 4676 WMIC.exe Token: SeSystemProfilePrivilege 4676 WMIC.exe Token: SeSystemtimePrivilege 4676 WMIC.exe Token: SeProfSingleProcessPrivilege 4676 WMIC.exe Token: SeIncBasePriorityPrivilege 4676 WMIC.exe Token: SeCreatePagefilePrivilege 4676 WMIC.exe Token: SeBackupPrivilege 4676 WMIC.exe Token: SeRestorePrivilege 4676 WMIC.exe Token: SeShutdownPrivilege 4676 WMIC.exe Token: SeDebugPrivilege 4676 WMIC.exe Token: SeSystemEnvironmentPrivilege 4676 WMIC.exe Token: SeRemoteShutdownPrivilege 4676 WMIC.exe Token: SeUndockPrivilege 4676 WMIC.exe Token: SeManageVolumePrivilege 4676 WMIC.exe Token: 33 4676 WMIC.exe Token: 34 4676 WMIC.exe Token: 35 4676 WMIC.exe Token: 36 4676 WMIC.exe Token: SeIncreaseQuotaPrivilege 4676 WMIC.exe Token: SeSecurityPrivilege 4676 WMIC.exe Token: SeTakeOwnershipPrivilege 4676 WMIC.exe Token: SeLoadDriverPrivilege 4676 WMIC.exe Token: SeSystemProfilePrivilege 4676 WMIC.exe Token: SeSystemtimePrivilege 4676 WMIC.exe Token: SeProfSingleProcessPrivilege 4676 WMIC.exe Token: SeIncBasePriorityPrivilege 4676 WMIC.exe Token: SeCreatePagefilePrivilege 4676 WMIC.exe Token: SeBackupPrivilege 4676 WMIC.exe Token: SeRestorePrivilege 4676 WMIC.exe Token: SeShutdownPrivilege 4676 WMIC.exe Token: SeDebugPrivilege 4676 WMIC.exe Token: SeSystemEnvironmentPrivilege 4676 WMIC.exe Token: SeRemoteShutdownPrivilege 4676 WMIC.exe Token: SeUndockPrivilege 4676 WMIC.exe Token: SeManageVolumePrivilege 4676 WMIC.exe Token: 33 4676 WMIC.exe Token: 34 4676 WMIC.exe Token: 35 4676 WMIC.exe Token: 36 4676 WMIC.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4576 wrote to memory of 4676 4576 cmd.exe 81 PID 4576 wrote to memory of 4704 4576 cmd.exe 82
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Loli.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get Model2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4676
-
-
C:\Windows\system32\findstr.exefindstr /i "DADY HARDDISK QEMU HARDDISK WDC WDS100T2B0A"2⤵PID:4704
-