073eb2fb4cb1cdbc14c435028dfd04ca631dac4d713b1bfce573f84e90757d37

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
agent_debug.bat
Size 67KB
Sample260508-seh24aav4x
SHA256 073eb2fb4cb1cdbc14c435028dfd04ca631dac4d713b1bfce573f84e90757d37
MD5 6f76956603354f2c7585707d6bbb2cde
SHA1 e53fb558d9bddf92a0e16083cc6ee223848d5a11
SHA512 9539554a1f70ca202fdfcef083a56a72c678eef59aa234791d3a6313eeebca732712898669f704eab97105102d0a0efe4c23414cbc273f7b0af9891bb0680de9
SSDEEP 1536:4tr/G+aID6KRt+VoHqrEFvZ5zK84WZ/HbaHpA8KtdoWteMR8e:C/GfIEG2k/K9WZ/7y9KiMR8e
TLSH
T164631F3DDAE1FDC0036F71D09A5E3B46205C5B23F6B16B6CF9C208A61964649DF3A25C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5048	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5048	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Prefetch\POWERSHELL.EXE-920BBA2A.pf	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5488	netsh.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5048	powershell.exe
5048	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5048	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 5048	4204	cmd.exe	83
PID 5048 wrote to memory of 5488	5048	powershell.exe	84
PID 5048 wrote to memory of 4600	5048	powershell.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\agent_debug.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -Command "$f='C:\Users\Admin\AppData\Local\Temp\10680.b64';$b=Get-Content $f -Raw;[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(($b -replace '\s',''))) | Invoke-Expression;Remove-Item $f -Force -EA 0"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5488
- - C:\Windows\system32\cmdkey.exe
    "C:\Windows\system32\cmdkey.exe" /list
    3⤵
    PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10680.b64

Path C:\Users\Admin\AppData\Local\Temp\10680.b64
Size 66KB
SHA256 2f19b6a5712b2b999e3f7f710fd84420fd91c2e2705e79e67cde619153e48444
MD5 73f8f85a86ac92ec3c54da664e639a24
SHA1 5f2380c5252e630f5da4aab67738ff6b7218dd0f
SHA512 46369c9d87662a0f281352a0209e41511044cc4b9fb55b8363898565e65e509a16114aba6d8335303c1e4c89c43423960b53c2fc648e592cb610a361c3685bb1
SSDEEP 1536:Rtr/G+aIDgKR/+VuHUrEpvZ5za8eWZPlba/pA8K9duWtCMRA:T/GfIIw8+/a9WZPho9KgMRA
TLSH
T1EA631F3DDAE1EDC0036F71D0995E3B86209C5B23F7B16B6CF9C208A61964649DF3A25C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10680.b64

Path C:\Users\Admin\AppData\Local\Temp\10680.b64
Size 23KB
SHA256 a80c0fe0d5c3748ac632bd9ee46191e926966832c88ac78f78662aeef9fa85db
MD5 8855e41da4eb38a419ea48a985dc53b5
SHA1 49e248ca9d97e68258edf5d0cd890d04f90ddedd
SHA512 99feb7fc6cee726a7d1de02c1992650c2afca89d179248f92c8fde404c21a1c196e1cc540ead32781d100930e74cec60875bb3ec28ee57d1967109ff9aa72280
SSDEEP 384:x0iy70e2iRKoAdxZoEoOC/QVmZPC2umCQu9iDcgihi9P3HPn0FKaXORTR9/03hqM:xL5Dr9xZo+CoMhHo9iQgKi9P/GQZ0xTp
TLSH
T1BDB20E3DDAE1BDC0036F71E0995E3B46209C1B23F7B16B6CF9C549AA1924648DF3A25C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wabkjxcf.jhj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wabkjxcf.jhj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5048-36-0x000001A943C20000-0x000001A944148000-memory.dmp

Download

memory/5048-51-0x000001A943490000-0x000001A9434D4000-memory.dmp

Download

memory/5048-19-0x000001A92A910000-0x000001A92A920000-memory.dmp

Download

memory/5048-35-0x000001A92A910000-0x000001A92A920000-memory.dmp

Download

memory/5048-34-0x000001A943520000-0x000001A9436E2000-memory.dmp

Download

memory/5048-18-0x000001A92A910000-0x000001A92A920000-memory.dmp

Download

memory/5048-37-0x000001A92A910000-0x000001A92A920000-memory.dmp

Download

memory/5048-27-0x000001A942F60000-0x000001A942F82000-memory.dmp

Download

memory/5048-52-0x000001A943770000-0x000001A9437E6000-memory.dmp

Download

memory/5048-53-0x000001A92A910000-0x000001A92A920000-memory.dmp

Download

memory/5048-54-0x000001A92A910000-0x000001A92A920000-memory.dmp

Download

memory/5048-55-0x000001A92A910000-0x000001A92A920000-memory.dmp

Download

memory/5048-56-0x000001A92A890000-0x000001A92A89C000-memory.dmp

Download

memory/5048-57-0x000001A942F90000-0x000001A942FFB000-memory.dmp

Download

memory/5048-58-0x000001A92A910000-0x000001A92A920000-memory.dmp

Download

memory/5048-79-0x000001A942F90000-0x000001A942FFB000-memory.dmp

Download