1beda4bfedcbf35898bd0241dad16bbd81e5cc929a5e9aefb1bd909acd171cc7

Analysis

max time kernel
298s
max time network
260s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/06/2026, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JKDzSAbmQ.bat
Size 9.8MB
Sample260618-rpft2saw8y
SHA256 1beda4bfedcbf35898bd0241dad16bbd81e5cc929a5e9aefb1bd909acd171cc7
MD5 9503620a013454835ce1c80ffe69d3ae
SHA1 235cc19f7ba3d02fcfb93c6eeea06318643be08c
SHA512 a37fa33f613e82bd2935379f6505d681b3233c67c2e99d2b3f97525e5e568c8173f13e086fd16c5c09e259a4948518df0606d2e55942775a0d14d5169ddc42af
SSDEEP 24576:PuSklOW3Scatm8ds0mxfSXYEoiVuhyOleW9Ih+0qnzDSSvOpKpPzB8AkEjOJ8r/y:N
TLSH
T1E9A6420773C6877C469007C4591BA6D2F227A0D4E02F999C8C2DB19425FB6FD8367AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4600	MSBuild.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4600	MSBuild.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	MSBuild.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 6008	4744	cmd.exe	84
PID 4744 wrote to memory of 4508	4744	cmd.exe	85
PID 4744 wrote to memory of 4500	4744	cmd.exe	86
PID 4500 wrote to memory of 4588	4500	conhost.exe	87
PID 4588 wrote to memory of 4628	4588	cmd.exe	88
PID 4588 wrote to memory of 4600	4588	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JKDzSAbmQ.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:6008
- C:\Windows\system32\where.exe
  where conhost.exe
  2⤵
  PID:4508
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JKDzSAbmQ.bat" /launched
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\System32\cmd.exe
    cmd.exe /c C:\Users\Admin\AppData\Local\Temp\JKDzSAbmQ.bat /launched
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4588
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4628
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\JKDzSAbmQ.bat"
      4⤵
      Deletes itself
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4600-0-0x0000000000D80000-0x0000000000DC0000-memory.dmp

Download

memory/4600-1-0x0000000003260000-0x000000000327A000-memory.dmp

Download

memory/4600-2-0x0000000005860000-0x00000000059BA000-memory.dmp

Download

memory/4600-3-0x0000000003250000-0x0000000003260000-memory.dmp

Download

memory/4600-4-0x00000000057C0000-0x00000000057F0000-memory.dmp

Download

memory/4600-5-0x0000000007380000-0x000000000738A000-memory.dmp

Download

memory/4600-6-0x0000000003250000-0x0000000003260000-memory.dmp

Download

memory/4600-7-0x000000000BA80000-0x000000000BD54000-memory.dmp

Download

memory/4600-8-0x0000000008F80000-0x0000000008FF0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads