a3c1a9061c4caddfa5023640eb8c33c3c99859320a8c3164e88facba9166bf35

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Dimmi/x64/Release/Spoof/Cleaners/clean2.bat
Size 265KB
Sample260604-s2vdmsaw2j
SHA256 a3c1a9061c4caddfa5023640eb8c33c3c99859320a8c3164e88facba9166bf35
MD5 ce55c0703b6be160771e927ba9de028f
SHA1 144d8889c6d21de0121e189ff3a3d9f607875faf
SHA512 a71678d1aa93a98c82721b351bb52aa339d374070aa85bb2a5782ee499823234d9bfdca1736c14dcba3626365059798275a6e55864cb7253a1895c91e4b82fdf
SSDEEP 1536:gwNoZxBOz2oofaCWfr3PwUWgM8361L5LvLpLjL5Gzf4oH9Gzf4gH9c:gLfaCWcUWgM+4oH9q4gH9c
TLSH
T1F744B0926219A632E867108CC3EF855E38B8D08615E137B251F5EE0CD98B83C557BEF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4552	sc.exe
5352	sc.exe
4276	sc.exe
2160	sc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5352	sc.exe
2160	sc.exe

Kills process with taskkill 15 IoCs

defense_evasion

pid	Process
3608	taskkill.exe
5980	taskkill.exe
4944	taskkill.exe
3024	taskkill.exe
3256	taskkill.exe
4380	taskkill.exe
4940	taskkill.exe
2360	taskkill.exe
2676	taskkill.exe
1460	taskkill.exe
3364	taskkill.exe
4044	taskkill.exe
1432	taskkill.exe
5444	taskkill.exe
5036	taskkill.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	5036	taskkill.exe
Token: SeDebugPrivilege	4944	taskkill.exe
Token: SeDebugPrivilege	4940	taskkill.exe
Token: SeDebugPrivilege	3024	taskkill.exe
Token: SeDebugPrivilege	2360	taskkill.exe
Token: SeDebugPrivilege	2676	taskkill.exe
Token: SeDebugPrivilege	1460	taskkill.exe
Token: SeDebugPrivilege	1432	taskkill.exe
Token: SeDebugPrivilege	3256	taskkill.exe
Token: SeDebugPrivilege	3608	taskkill.exe
Token: SeDebugPrivilege	5444	taskkill.exe
Token: SeDebugPrivilege	3364	taskkill.exe
Token: SeDebugPrivilege	4380	taskkill.exe
Token: SeDebugPrivilege	5980	taskkill.exe
Token: SeDebugPrivilege	4044	taskkill.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 4820	3264	cmd.exe	80
PID 3264 wrote to memory of 5036	3264	cmd.exe	81
PID 3264 wrote to memory of 4944	3264	cmd.exe	83
PID 3264 wrote to memory of 4940	3264	cmd.exe	84
PID 3264 wrote to memory of 3024	3264	cmd.exe	85
PID 3264 wrote to memory of 2360	3264	cmd.exe	86
PID 3264 wrote to memory of 2676	3264	cmd.exe	87
PID 3264 wrote to memory of 1460	3264	cmd.exe	88
PID 3264 wrote to memory of 1432	3264	cmd.exe	89
PID 3264 wrote to memory of 3256	3264	cmd.exe	90
PID 3264 wrote to memory of 3608	3264	cmd.exe	91
PID 3264 wrote to memory of 5444	3264	cmd.exe	92
PID 3264 wrote to memory of 3364	3264	cmd.exe	93
PID 3264 wrote to memory of 4380	3264	cmd.exe	94
PID 3264 wrote to memory of 5980	3264	cmd.exe	95
PID 3264 wrote to memory of 4044	3264	cmd.exe	96
PID 3264 wrote to memory of 4552	3264	cmd.exe	97
PID 3264 wrote to memory of 5352	3264	cmd.exe	98
PID 3264 wrote to memory of 4276	3264	cmd.exe	99
PID 3264 wrote to memory of 2160	3264	cmd.exe	100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Dimmi\x64\Release\Spoof\Cleaners\clean2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:4820
- C:\Windows\system32\taskkill.exe
  taskkill /f /im epicgameslauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4944
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4940
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3024
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OneDrive.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1460
- C:\Windows\system32\taskkill.exe
  taskkill /f /im UnrealCEFSubProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1432
- C:\Windows\system32\taskkill.exe
  taskkill /f /im CEFProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3256
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3608
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5444
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEServices.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3364
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BattleEye.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4380
- C:\Windows\system32\taskkill.exe
  taskkill /f /im PerfWatson2.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5980
- C:\Windows\system32\taskkill.exe
  taskkill /f /im vgtray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4044
- C:\Windows\system32\sc.exe
  Sc stop EasyAntiCheat
  2⤵
  - Launches sc.exe
  PID:4552
- C:\Windows\system32\sc.exe
  Sc stop FortniteClient-Win64-Shipping_EAC
  2⤵
  - Launches sc.exe
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5352
- C:\Windows\system32\sc.exe
  Sc stop BattleEye
  2⤵
  - Launches sc.exe
  PID:4276
- C:\Windows\system32\sc.exe
  Sc stop FortniteClient-Win64-Shipping_BE
  2⤵
  - Launches sc.exe
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2160