Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system - submitted
12/01/2026, 00:24
Static task
static1
Behavioral task
behavioral1
Sample
Loli.bat
Resource
win10v2004-20251231-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loli.bat
Resource
win10ltsc2021-20251231-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Loli.bat
Resource
win11-20251231-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target Loli.bat
- Size 4.8MB
- Sample260112-ap7jbshs4c
- SHA256 92998568b2f00bf512907123c94562bdac71474e675f8c878044c7fb26cd4dfb
- MD5 22f0e9809da9691208ebff4b54d412f8
- SHA1 d80f15ee71ab187fd4c27abbc666d2eb3a92cb09
- SHA512 a53bfcfaa6505eb39a60a77c48ecdc72a249cd8ab0c55e8a935e1ea95d2b20944eaf1311e91b3d91672fcaf814c6cff040443228297c5c7e2df99fd3230e60fd
- SSDEEP 49152:a1RUIhoN014ZdRV6mMycZyNY1ARMhVYuKrfQOJ/21RtSQfIvhSgeOQ:y
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5848 WMIC.exe Token: SeSecurityPrivilege 5848 WMIC.exe Token: SeTakeOwnershipPrivilege 5848 WMIC.exe Token: SeLoadDriverPrivilege 5848 WMIC.exe Token: SeSystemProfilePrivilege 5848 WMIC.exe Token: SeSystemtimePrivilege 5848 WMIC.exe Token: SeProfSingleProcessPrivilege 5848 WMIC.exe Token: SeIncBasePriorityPrivilege 5848 WMIC.exe Token: SeCreatePagefilePrivilege 5848 WMIC.exe Token: SeBackupPrivilege 5848 WMIC.exe Token: SeRestorePrivilege 5848 WMIC.exe Token: SeShutdownPrivilege 5848 WMIC.exe Token: SeDebugPrivilege 5848 WMIC.exe Token: SeSystemEnvironmentPrivilege 5848 WMIC.exe Token: SeRemoteShutdownPrivilege 5848 WMIC.exe Token: SeUndockPrivilege 5848 WMIC.exe Token: SeManageVolumePrivilege 5848 WMIC.exe Token: 33 5848 WMIC.exe Token: 34 5848 WMIC.exe Token: 35 5848 WMIC.exe Token: 36 5848 WMIC.exe Token: SeIncreaseQuotaPrivilege 5848 WMIC.exe Token: SeSecurityPrivilege 5848 WMIC.exe Token: SeTakeOwnershipPrivilege 5848 WMIC.exe Token: SeLoadDriverPrivilege 5848 WMIC.exe Token: SeSystemProfilePrivilege 5848 WMIC.exe Token: SeSystemtimePrivilege 5848 WMIC.exe Token: SeProfSingleProcessPrivilege 5848 WMIC.exe Token: SeIncBasePriorityPrivilege 5848 WMIC.exe Token: SeCreatePagefilePrivilege 5848 WMIC.exe Token: SeBackupPrivilege 5848 WMIC.exe Token: SeRestorePrivilege 5848 WMIC.exe Token: SeShutdownPrivilege 5848 WMIC.exe Token: SeDebugPrivilege 5848 WMIC.exe Token: SeSystemEnvironmentPrivilege 5848 WMIC.exe Token: SeRemoteShutdownPrivilege 5848 WMIC.exe Token: SeUndockPrivilege 5848 WMIC.exe Token: SeManageVolumePrivilege 5848 WMIC.exe Token: 33 5848 WMIC.exe Token: 34 5848 WMIC.exe Token: 35 5848 WMIC.exe Token: 36 5848 WMIC.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5008 wrote to memory of 5848 5008 cmd.exe 78 PID 5008 wrote to memory of 464 5008 cmd.exe 79
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Loli.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get Model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5848
-
-
C:\Windows\system32\findstr.exefindstr /i "DADY HARDDISK QEMU HARDDISK WDC WDS100T2B0A"2⤵PID:464
-