7f6fc0c87fcc5af625a5ba3838e49bd6f2890507668cd47522dc95cce2495c07

Resubmissions

07/07/2026, 17:24

260707-vyym1aaw3t

07/07/2026, 17:20

260707-vwlknabs3n8

Analysis

user interaction
yes
max time kernel
7s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FSRealisticHelper.bat
Size 6.4MB
Sample260707-vwlknabs3n
SHA256 7f6fc0c87fcc5af625a5ba3838e49bd6f2890507668cd47522dc95cce2495c07
MD5 26d82f20c25d13e50852d81adceefab7
SHA1 62bdd86081f6cc1b94b0c9b73597aa2c9fea7c95
SHA512 cd703eb7ae553b2b7a29a464d2d2e9d96d3e851b69a2b5be202e80574b6dd8f7784fa799bc54de327bb64c03896a745e0aa16987d45f28bb4db7e404ba44cf17
SSDEEP 49152:MpZKohmrlXoVIxygp6GYhDsnNdi4okpSlYjfyQcOk9gGuJVmgUj5/L3wLzYxe17F:t
TLSH
T173663311DDA9BEAE496C8338716F5F1F2BB04ED1848CB5DA839060D7129FF81069BC79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2092	powershell.exe
4312	powershell.exe
2360	powershell.exe
2528	powershell.exe
2892	powershell.exe
1928	powershell.exe
4888	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2092	powershell.exe
2092	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 2092	4320	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FSRealisticHelper.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -C "Unblock-File 'C:\Users\Public\khslstgr.bat'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "E" /d "C:\Users\Public\khslstgr.bat" /f
  2⤵
  PID:4368
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "E" /d "C:\Users\Public\khslstgr.bat" /f
  2⤵
  PID:6124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -C "Unblock-File 'C:\Users\Public\khslstgr.bat';Start-Process powershell -WindowStyle Hidden -ArgumentList '-NoP','-C','iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:B64)))'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:B64)))
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2892
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ktasj13w\ktasj13w.cmdline"
      4⤵
      PID:1736
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE8A1.tmp" "c:\Users\Admin\AppData\Local\Temp\ktasj13w\CSCC362EA32AAFC4BA99B1F5381F5D8B545.TMP"
        5⤵
        
        PID:1332

C:\Windows\System32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "E" /d "C:\Users\Public\khslstgr.bat" /f
1⤵
PID:5168

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoP -C "Unblock-File 'C:\Users\Public\khslstgr.bat';Start-Process powershell -WindowStyle Hidden -ArgumentList '-NoP','-C','iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:B64)))'"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:B64)))
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1928
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4kguhoyd\4kguhoyd.cmdline"
    3⤵
    PID:2780
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESECA8.tmp" "c:\Users\Admin\AppData\Local\Temp\4kguhoyd\CSCF35F04995FC94F9DA618B4CCC994F554.TMP"
      4⤵
      PID:2956

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3460
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:2520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Public\khslstgr.bat" "
    3⤵
    PID:1220
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "E" /d "C:\Users\Public\khslstgr.bat" /f
      4⤵
      PID:5096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -C "Unblock-File 'C:\Users\Public\khslstgr.bat';Start-Process powershell -WindowStyle Hidden -ArgumentList '-NoP','-C','iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:B64)))'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4312
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:B64)))
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4888
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o4mmot5x\o4mmot5x.cmdline"
        6⤵
        
        PID:3372
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA2C.tmp" "c:\Users\Admin\AppData\Local\Temp\o4mmot5x\CSC6F6CC297F19543D7BF26716AFB4256DE.TMP"
        7⤵
        
        PID:4624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4996

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:1244

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1620

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a34855 /state1:0x41c64e6d
1⤵
PID:2836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...