a459bad3ed452ccb3ec8d5bd67139e677cbf636f7032f018e8420b9113272546

Resubmissions

25/04/2026, 15:29

25/04/2026, 15:28

max time kernel
26s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 15:28

Target
Heilong Botnet.bat
Size 3.4MB
Sample260425-swfcjact5x
SHA256 a459bad3ed452ccb3ec8d5bd67139e677cbf636f7032f018e8420b9113272546
MD5 e2298a465e53d29117daae8f05b8f39c
SHA1 3aecfac2dd4f769fc4233811b2da93ec6eba752a
SHA512 a37b72614cc25ad8ec71a9ec4f5776e1e311ea367f6941c5c33c1d23e76f8a6921b9c1cdc3db3ff655b5194b034fbefb198854bce6329021a6d3b95a998375b2
SSDEEP 3072:W+upZkylgYDm1xoX46rB95XLPNwtFnxnJyASO0Bux80LuWT3O:W+wkweN6rBTrKt5xJ4Bu80LTT+
TLSH
T17AF5AF11461CCE3B6365126A10EA1E0E15C8CB8043715BEBFDA95AC9277EF132B6A3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 1824	3264	cmd.exe	81
PID 3264 wrote to memory of 1456	3264	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Heilong Botnet.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo \\DADDYSERVER "
  2⤵
  PID:1824
- C:\Windows\system32\findstr.exe
  findstr /i "DADDYSERVER"
  2⤵
  PID:1456