9959530d9d12038ba5deedab246fddcb94d7ce70e860ed4c8c4e8152d460a8f1

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hold.bat
Size 3.3MB
Sample260620-antwvadx2x
SHA256 9959530d9d12038ba5deedab246fddcb94d7ce70e860ed4c8c4e8152d460a8f1
MD5 e8f900ac9870fbb8bcde5f5fa422c86c
SHA1 dd3f2aed43b5da4401e7383c4aa93df900a97fbd
SHA512 ff15174559efa8e7c5c7ee32c105c56c086f02bb69588a84b07bed6214098b649f5727d587007d8bcf37288926f759f93f71b19029daf4531e6ac019b8cc5395
SSDEEP 24576:ct9hWKcEjJ18DLLujnOK5qrYkXpOtzH/VUuj/z++jgtix6cVZiN2jcJ42T+EQuAx:cqgjnOKeZXIBVUtSfI/rsOUZhxtXj
TLSH
T1CBF5E12B6C8119A42725473B3BAFF00A4BFF1CA20FC5AD519BD7590A69F170F0A751B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3300	powershell.exe
2640	powershell.exe
4280	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2640 set thread context of 1804	2640	powershell.exe	96

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3300	powershell.exe
3300	powershell.exe
4280	powershell.exe
4280	powershell.exe
2640	powershell.exe
2640	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 3300	5036	cmd.exe	89
PID 3300 wrote to memory of 2160	3300	powershell.exe	90
PID 2160 wrote to memory of 4280	2160	cmd.exe	92
PID 2160 wrote to memory of 2640	2160	cmd.exe	93
PID 2640 wrote to memory of 5600	2640	powershell.exe	94
PID 5600 wrote to memory of 1936	5600	csc.exe	95
PID 2640 wrote to memory of 1804	2640	powershell.exe	96
PID 2640 wrote to memory of 1804	2640	powershell.exe	96
PID 2640 wrote to memory of 1804	2640	powershell.exe	96
PID 2640 wrote to memory of 1804	2640	powershell.exe	96
PID 2640 wrote to memory of 1804	2640	powershell.exe	96
PID 2640 wrote to memory of 1804	2640	powershell.exe	96
PID 2640 wrote to memory of 1804	2640	powershell.exe	96
PID 2640 wrote to memory of 1804	2640	powershell.exe	96
PID 2640 wrote to memory of 1804	2640	powershell.exe	96
PID 2640 wrote to memory of 1804	2640	powershell.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hold.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "$q=[char]34;$a='/c '+$q+$q+$env:_SelfPathRef+$q+$q+' __hidden';$i=New-Object System.Diagnostics.ProcessStartInfo('C:\Windows\System32\cmd.exe',$a);$i.WindowStyle=[System.Diagnostics.ProcessWindowStyle]::Hidden;[System.Diagnostics.Process]::Start($i)|Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\hold.bat"" __hidden
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=[IO.File]::ReadAllBytes('C:\Users\Admin\AppData\Local\Temp\hold.bat');$t=[Text.Encoding]::ASCII.GetString($b);$i=$t.LastIndexOf('---BEGIN_PS---');if($i -ge 0){[IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\volatile_module_101812181716867.ps1',[Convert]::FromBase64String(($t.Substring($i+14)-replace'[\r\n]','')))}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\volatile_module_101812181716867.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iekcncot\iekcncot.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5600
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES747A.tmp" "c:\Users\Admin\AppData\Local\Temp\iekcncot\CSC552F84DF582444C18543A471B257FBE4.TMP"
        6⤵
        
        PID:1936
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:1804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 babf4bdb5efb566561547504b88d16f5da265610302d2771144da0b82c8c851d
MD5 61caa6336a77282831e9db0bc6f0af0f
SHA1 666e2470f4fecb03f5ccc86ceb81faacccaf7219
SHA512 26e07cff5d8e30eaa1e46aad4eb8a163435b25937087f3a55950571dc8f58e35e6e8b273f1e860d54bbc76a44a5eb1a6d77c5844546734099aeb6af07f2bb04f
TLSH
T1A8215733F3CC8624DC9A403650CEAC1136B687DB409EDE6BBB84D545B42F689DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 6ce2b5ee268c8304cedc5c8b55084d5117abfd94a996ca59303190e47acd1261
MD5 e6be6c3186bd934b32e3c5d221b71b7b
SHA1 289c3afda412865e6cd0fb4b26dee677aa15a022
SHA512 0aa5ef9546b632eb736c6b0ad2f17af43efaabe15030d24d7edd558c5043780f12cf7f35aa325ce372e5a4499e28d23c22afd0ea7429868fc2257de8eb483c48
TLSH
T1C1116633F3CC86A4DD59413650CEAD1136B787CB409EDE9B7B84C155B86F685CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

RES747A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES747A.tmp
Size 1KB
SHA256 5807def73e11f13152079d09ba9febf30934bfa624c7e81a11def471655efbb4
MD5 1431c10f3c5c8148ac1e1fb2ea13a29b
SHA1 f9d91ac70102ace660e9f229993585f35d2eb1c9
SHA512 ac2f1bb33b3401104229dd7dfac7d157f9af850e56ee0811d218b9b75952e18113d29226d302adfbf42f9fdb54406a96adfe02bf2f6fef3aae44befa5d439612
TLSH
T1DB21CC0553ED871FF073473169F6071FA674FD54EFA1A79A8440412D2C51944EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_r3vqw2zn.xgf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r3vqw2zn.xgf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

iekcncot.dll

Path C:\Users\Admin\AppData\Local\Temp\iekcncot\iekcncot.dll
Size 5KB
SHA256 62d6542bea33f1839e9956e928d02f5e6efbb73a487457eac45f424536e535b9
MD5 d1a84b0be22d158cf8b5149daaac623b
SHA1 c9076c7ace2906936e6c528d287691635976c722
SHA512 4c5d2cccdfc3ac27eced7527908adba689dd3c636af3d514f052749673d15cefcccafa77b60b1de1484a27a64db1942d7f256d089867c20adaf5cf364fc5c828
SSDEEP 48:6rnjY3k8xLJpXsOVXWZY/Mc8FfxOZvhpzmmIfib1gbmgDngdJ6pjBLYoB1ulea33:wYZx9pXsO837SpkrTLYXQK
TLSH
T151C16311D79C1293F9AB033CADE30B12DB70A8914B6B875B0DD5A21A6CABB741A35760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

volatile_module_101812181716867.ps1

Path C:\Users\Admin\AppData\Local\Temp\volatile_module_101812181716867.ps1
Size 2.4MB
SHA256 ab819fb6448c06c033d4999637e8e7b3a08bf1cefa80d25fe34350afbc2ec749
MD5 34b1bfcf44dc538104dc874e5f486779
SHA1 f2a80543975a64bc69f74aee8024fbef4da00b8a
SHA512 60bc128e6b8760dc6b5dda537e753da7811b6e656c503fcbc0c35f409e58f8d174659f535a65580e363da4a565d0dbb985bc4bfadfd879ce2d87da854db00885
SSDEEP 49152:3XO2GWKGvLkcfN5G/Fv/y7f2glLLF9r5i59hNDhQ2qtxE:nhZT1OFv/yPlL5o9dQ2E2
TLSH
T1ADC5CF909C5F833BCB9F8D0550FBFB17A626B7027AD7274AC8B49051CF59A00AD56C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC552F84DF582444C18543A471B257FBE4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\iekcncot\CSC552F84DF582444C18543A471B257FBE4.TMP
Size 652B
SHA256 0b2da465c6c72441ccc725356d74343b71bce236cc32c7c755662c4c67c26b7b
MD5 2a478b46e09eb99b6dcee4e7aedaede1
SHA1 724467788afdc65b0930bc1b267d6a9582cd3be9
SHA512 7071bb3457f6d724e6dd73998514f2d3bb2511f80ca137341aa934b1e4a21a327f642f02aa2e496ed8f5d5286ecd1b7f3f85d7bbd24e1fca919bf5c00ff98680
TLSH
T193F05E0963F8420EF0F34B30BDF6436395B8BC65DE3293ED1440031D28649108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

iekcncot.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\iekcncot\iekcncot.0.cs
Size 3KB
SHA256 9578f1935441fa1f73ff75db335d4a8693ca649925853908d83e6e4b8a3838d7
MD5 e77027a3d1f4e8d99e8aaac444f615a1
SHA1 12d313fa966c5e0c37c30fa4d056f220d3062349
SHA512 44038a7674713e57557a33d9c1da9a3986eb5e720fe4fe7a3a1a11c3fad781fd60f7fda25ca1dfb3ca1831ef9040adb0a99da0ac3180fc605ec059a2d64b0727
TLSH
T1EE71DF3C5346976258761119FA81A1CEE70310732AFF5A2039FD83626F7B109E176B2E
MD5 SHA1 SHA512 TLSH

Submit Download

iekcncot.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\iekcncot\iekcncot.cmdline
Size 369B
SHA256 083ad0f30bb62f4049f071cbcb28f05b9a1c705d407190621f4e9d5339b517ae
MD5 dee1b4883b8c238f82494c41f3ac311c
SHA1 1f8c43876ff939c17bce128552f3a51e9759a523
SHA512 cbf775bd9251aad1e012e20cdd04d9bed1978fdfe6b5c8d41ea166884dab4ceacb2dec445aa0633a9574e7f3d17a622ba0bc13e9d4a05bfe2dc58663a8049389
TLSH
T1E9E06F3E424BC27D01EB100B26FBC5AC8672078B2D803FE69040849DE027480ABD3786
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1804-43-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2640-42-0x000002A734FB0000-0x000002A734FB8000-memory.dmp

Download

memory/3300-9-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/3300-7-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/3300-4-0x00000279EBE00000-0x00000279EBE22000-memory.dmp

Download

memory/3300-3-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/3300-5-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/3300-6-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/3300-14-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/3300-8-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/3300-13-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/3300-11-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/3300-10-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/3300-0-0x00007FFA2DA3F000-0x00007FFA2DA40000-memory.dmp

Download

memory/4280-25-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/4280-15-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/4280-19-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/4280-18-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/4280-17-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download

memory/4280-16-0x00007FFA2D8B0000-0x00007FFA2E254000-memory.dmp

Download