3a585edff62ebe7979ade207f07d1a57a80eb15b8fd7f32c7c73492dedefd498

Resubmissions

06/10/2026, 23:32

261006-3jfgwaht5t

20/09/2026, 09:28

24/08/2026, 17:36

24/08/2026, 17:33

24/08/2026, 17:18

24/08/2026, 17:15

21/03/2026, 04:21

Analysis

user interaction
yes
max time kernel
67s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/03/2026, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ByeBanAsync.exe
Size 335KB
Sample260321-eymbzags2s
SHA256 3a585edff62ebe7979ade207f07d1a57a80eb15b8fd7f32c7c73492dedefd498
MD5 33d4249e754eb34cd606404ef1567a58
SHA1 b6deb21358fe87135a3ac5893f4cf5549f5e505d
SHA512 ac81e82ac4417084e4c7ba23798ba908fda7234b4c6a4d2dbed272e26ae6068bd1def5eaaf6d5f23a3bf84b4f3f1a3d66e697961cdaae01ea4f043b5e1334586
SSDEEP 6144:pBqxfdURSFpIgXcoFJ37GqYl7X6BCrX53PTkEO/xQE0P/GctIkEJZHc:poxtIgXlKhT53QEORHVkOc
TLSH
T102744A21FE9569ECD14AC0B483468A726A72B4CE1B31A9FF12C441353F6DAF55F3CA18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2424	2832	ByeBanAsync.exe	80
PID 2832 wrote to memory of 2424	2832	ByeBanAsync.exe	80

C:\Users\Admin\AppData\Local\Temp\ByeBanAsync.exe
"C:\Users\Admin\AppData\Local\Temp\ByeBanAsync.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\system32\netsh.exe
  "netsh" interface set interface name= Ethernet admin=disable
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2424

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads