d85212fb199f19195e6b658c8f14241d91d6454e8cef78ab0ee21aa3c676d5c8

Analysis

user interaction
yes
max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
caceta.bat
Size 1.3MB
Sample260423-dc2dbshs9y
SHA256 d85212fb199f19195e6b658c8f14241d91d6454e8cef78ab0ee21aa3c676d5c8
MD5 5f25623e0834fec43e849a5be4317c0c
SHA1 c7a0fb356fd9de012e6e503ecc5bdfbb0a4daaee
SHA512 addb9474b9cc61f346a23bcadd755c0a078dd974aee7fbd5f11d79d660ff62c8a00ce0c0c8da070f5979e7b85ccbb7bfbd7d0df6e463dcd70d97c7f7642bfa76
SSDEEP 24576:tszxN8Nmmx5+MiTj2WhLS9nE1IpfIjAMhr/RxZi7F1Sn:GxNKx5+T8wjAI
TLSH
T12255AE36AA02FCD94BAF1964CC1C3A1A2D253E536E685958F58214B51E9C0F8FF7D0EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1748	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LAnoXOM.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LAnoXOM.bat	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 1748	3328	cmd.exe	80

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\caceta.bat"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$t = Get-Content 'C:\Users\Admin\AppData\Local\Temp\YHgsuG.tmp' -Raw
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YHgsuG.tmp

Path C:\Users\Admin\AppData\Local\Temp\YHgsuG.tmp
Size 6KB
SHA256 6c8f31b6ba326a6c1237398f4abb30c1f635b116b3927a30055c076b4da9b606
MD5 3a9e85f38613f64572fcc7e95879f90f
SHA1 2344a783a3671b3efcb97c8d088b8e7798c6cb05
SHA512 b6aa98949023335149f82162eb6e26cb0bb0a9378c995d5942dfc3450f7bd7b7efeb726365a5a524941afbf353acdba67ff47d97b3f05377fc9fbe1ecfceee90
SSDEEP 96:Ra2VtdDSb/2x9lxLmEZaTbMCuTbuG1OmB+PYF5/htXxqRo+mA9+PdyadznHdo9A:I8dAK9lxSUAbMCPml5JJERVmyA
TLSH
T193D1B5331002BCC176B70D80F544B2258C5ABAF7F6CA5528BAC056A935DFA20DE5DEB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download