6e1c01fa1c4e65dad20daebe1c00c73b02a4ede6525f091314e52a8848201e1d

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sul_File_Hider.bat
Size 7KB
Sample260529-vr856aay2y
SHA256 6e1c01fa1c4e65dad20daebe1c00c73b02a4ede6525f091314e52a8848201e1d
MD5 6be49a5f277146b78b3ce8ba2d2358b5
SHA1 c1fdb70ea3f73c2e2822eb86eb33cebcd97f269b
SHA512 1b40a28679a60788a13ac6ad0861fe7986d2a5a390552acdf78f793e2fffa6f50d6efc9d92b7611f7dbb67e8c1ad4e6e2c65f8aeec5e2ad22d91f30cc7d508d1
SSDEEP 96:Z0TIDTsvGGGKtQClhtrUbT7MNMC107sPNEYIDKvUi:ZbDTsjttYwf1fPCDKb
TLSH
T17DF19465BC40AD1A1C798BB2763461F4F314C09F065D6AAE740FB0706FEC7C614AEAE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3384	attrib.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1376	PING.EXE
3016	PING.EXE
864	PING.EXE
3632	PING.EXE
912	PING.EXE
3640	PING.EXE
4624	PING.EXE
772	PING.EXE
3788	PING.EXE
4420	PING.EXE

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
4420	PING.EXE
1376	PING.EXE
3016	PING.EXE
4624	PING.EXE
772	PING.EXE
3632	PING.EXE
3640	PING.EXE
864	PING.EXE
3788	PING.EXE
912	PING.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1680	2332	cmd.exe	81
PID 2332 wrote to memory of 3016	2332	cmd.exe	82
PID 2332 wrote to memory of 4624	2332	cmd.exe	83
PID 2332 wrote to memory of 864	2332	cmd.exe	84
PID 2332 wrote to memory of 772	2332	cmd.exe	85
PID 2332 wrote to memory of 3632	2332	cmd.exe	86
PID 2332 wrote to memory of 3788	2332	cmd.exe	87
PID 2332 wrote to memory of 912	2332	cmd.exe	88
PID 2332 wrote to memory of 3640	2332	cmd.exe	89
PID 2332 wrote to memory of 4420	2332	cmd.exe	90
PID 2332 wrote to memory of 1376	2332	cmd.exe	91
PID 2332 wrote to memory of 2624	2332	cmd.exe	92
PID 2332 wrote to memory of 3384	2332	cmd.exe	93

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3384	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Sul_File_Hider.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy /Z "C:\Users\Admin\AppData\Local\Temp\Sul_File_Hider.bat" nul
  2⤵
  PID:1680
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3016
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4624
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:864
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:772
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3632
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3788
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:912
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3640
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4420
- C:\Windows\system32\PING.EXE
  ping -n 2 ""
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1376
- C:\Windows\system32\mode.com
  mode con: cols=65 lines=22
  2⤵
  PID:2624
- C:\Windows\system32\attrib.exe
  attrib +S +H "C:\Users\Admin\Contacts\FFHide"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads