3bcb2b6c2f64bb88a2d096d4f93c860608c3a99cafdb971e2807bb123f288ab4

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
20s
max time network
19s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/06/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Aura.bat
Size 2KB
Sample260624-eecnesh14p
SHA256 3bcb2b6c2f64bb88a2d096d4f93c860608c3a99cafdb971e2807bb123f288ab4
MD5 5ac7bb91aab2c03cde8d75ff006ead1a
SHA1 0685e00879482c6c3b49904b257c76c577acb7eb
SHA512 78c946c40bd45dea8a482d941cff60defebc17ac2648793ae677579e4e089e5ff5043acfc8c2d19389a79a6d550d4ae6ea790b9fe3a4f726446f516b4c71425a
TLSH
T12D5144077843D2A42AE11EC5EB672266AA43C0674F64F1D83AB7533DA54747642FE0CB
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4936	sc.exe
3464	sc.exe
5828	sc.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
3852	timeout.exe
5324	timeout.exe
2036	timeout.exe

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
2316	taskkill.exe
4880	taskkill.exe
4952	taskkill.exe
5080	taskkill.exe
1224	taskkill.exe
4300	taskkill.exe
3024	taskkill.exe
5660	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4880	taskkill.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	5080	taskkill.exe
Token: SeDebugPrivilege	1224	taskkill.exe
Token: SeDebugPrivilege	4300	taskkill.exe
Token: SeDebugPrivilege	3024	taskkill.exe
Token: SeDebugPrivilege	5660	taskkill.exe
Token: SeDebugPrivilege	2316	taskkill.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 3672	4548	cmd.exe	83
PID 4548 wrote to memory of 552	4548	cmd.exe	84
PID 552 wrote to memory of 4940	552	net.exe	85
PID 4548 wrote to memory of 5828	4548	cmd.exe	86
PID 4548 wrote to memory of 4880	4548	cmd.exe	87
PID 4548 wrote to memory of 4952	4548	cmd.exe	89
PID 4548 wrote to memory of 5080	4548	cmd.exe	90
PID 4548 wrote to memory of 2036	4548	cmd.exe	91
PID 4548 wrote to memory of 2136	4548	cmd.exe	92
PID 2136 wrote to memory of 5560	2136	net.exe	93
PID 4548 wrote to memory of 4936	4548	cmd.exe	94
PID 4548 wrote to memory of 1224	4548	cmd.exe	95
PID 4548 wrote to memory of 4300	4548	cmd.exe	96
PID 4548 wrote to memory of 3852	4548	cmd.exe	97
PID 4548 wrote to memory of 5488	4548	cmd.exe	98
PID 5488 wrote to memory of 1356	5488	net.exe	99
PID 4548 wrote to memory of 3464	4548	cmd.exe	100
PID 4548 wrote to memory of 3024	4548	cmd.exe	101
PID 4548 wrote to memory of 5660	4548	cmd.exe	102
PID 4548 wrote to memory of 2316	4548	cmd.exe	103
PID 4548 wrote to memory of 5324	4548	cmd.exe	104
PID 4548 wrote to memory of 3884	4548	cmd.exe	105

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Aura.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3672
- C:\Windows\system32\net.exe
  net stop VeyonService
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop VeyonService
    3⤵
    PID:4940
- C:\Windows\system32\sc.exe
  sc delete VeyonService
  2⤵
  - Launches sc.exe
  PID:5828
- C:\Windows\system32\taskkill.exe
  taskkill /f /im veyon-service.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4880
- C:\Windows\system32\taskkill.exe
  taskkill /f /im veyon-worker.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\system32\taskkill.exe
  taskkill /f /im veyon-master.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5080
- C:\Windows\system32\timeout.exe
  timeout /t 0
  2⤵
  - Delays execution with timeout.exe
  PID:2036
- C:\Windows\system32\net.exe
  net stop "OCS Inventory Service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "OCS Inventory Service"
    3⤵
    PID:5560
- C:\Windows\system32\sc.exe
  sc delete "OCS Inventory Service"
  2⤵
  - Launches sc.exe
  PID:4936
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OcsService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Windows\system32\taskkill.exe
  taskkill /f /im OcsSystray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- C:\Windows\system32\timeout.exe
  timeout /t 0
  2⤵
  - Delays execution with timeout.exe
  PID:3852
- C:\Windows\system32\net.exe
  net stop Deep Freeze
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5488
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Deep Freeze
    3⤵
    PID:1356
- C:\Windows\system32\sc.exe
  sc delete Deep Freeze
  2⤵
  - Launches sc.exe
  PID:3464
- C:\Windows\system32\taskkill.exe
  taskkill /f /im DFServ.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3024
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FrzState2k.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5660
- C:\Windows\system32\taskkill.exe
  taskkill /f /im DFLocker64.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Windows\system32\timeout.exe
  timeout /t 0
  2⤵
  - Delays execution with timeout.exe
  PID:5324
- C:\Windows\system32\choice.exe
  choice /c 12345 /n /m "Opcão: "
  2⤵
  PID:3884