8192fc2de75163a001245f6b61dcc174563cefa5727ea5055587276bd59daaa1

Analysis

max time kernel
149s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Base-FirewallRules-Update.bat
Size 2KB
Sample260709-alg49saz5m
SHA256 8192fc2de75163a001245f6b61dcc174563cefa5727ea5055587276bd59daaa1
MD5 756dbe9f32fe00800142d49c947107cc
SHA1 1d200199c3dc6ab3722804d61c67223167ae7323
SHA512 8d847811dd6ad43ca775af9293ef2f16cafc813e35e5213a0d35a2d389f7e4efda51d146c8c03d5bf6601aa233bb5f54b6c230f259e8165714c6425a2afecc87
TLSH
T10851E940867D6AE25A83EBB9B9426B10020CB34EFA5C7CC81B936207E4516A913FF45B
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 17 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4884	netsh.exe
2788	netsh.exe
3684	netsh.exe
636	netsh.exe
2652	netsh.exe
4032	netsh.exe
2164	netsh.exe
2496	netsh.exe
4840	netsh.exe
4152	netsh.exe
2200	netsh.exe
2436	netsh.exe
3844	netsh.exe
1824	netsh.exe
2948	netsh.exe
648	netsh.exe
2920	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 2200	1508	cmd.exe	88
PID 1508 wrote to memory of 2788	1508	cmd.exe	89
PID 1508 wrote to memory of 3684	1508	cmd.exe	90
PID 1508 wrote to memory of 4032	1508	cmd.exe	91
PID 1508 wrote to memory of 2164	1508	cmd.exe	92
PID 1508 wrote to memory of 648	1508	cmd.exe	93
PID 1508 wrote to memory of 2496	1508	cmd.exe	94
PID 1508 wrote to memory of 2436	1508	cmd.exe	95
PID 1508 wrote to memory of 636	1508	cmd.exe	96
PID 1508 wrote to memory of 3844	1508	cmd.exe	97
PID 1508 wrote to memory of 1824	1508	cmd.exe	98
PID 1508 wrote to memory of 4840	1508	cmd.exe	99
PID 1508 wrote to memory of 2652	1508	cmd.exe	100
PID 1508 wrote to memory of 4152	1508	cmd.exe	101
PID 1508 wrote to memory of 2948	1508	cmd.exe	102
PID 1508 wrote to memory of 2920	1508	cmd.exe	103
PID 1508 wrote to memory of 4884	1508	cmd.exe	104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Base-FirewallRules-Update.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - NPLEX-Port-3151" dir=out action=allow remoteip=45.60.18.60,45.60.20.60,45.60.12.60,45.60.16.60,45.60.14.60 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2200
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - NPLEX-Port-3151" dir=in action=allow remoteip=45.60.18.60,45.60.20.60,45.60.12.60,45.60.16.60,45.60.14.60 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2788
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - Datacap-Port-9000" dir=out action=allow localport=9000 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3684
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - Datacap-Port-9000" dir=in action=allow localport=9000 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4032
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - StarPlus-Port-3125 (DB)" dir=in action=allow localport=3125 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2164
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - StarPlus-Port-4125 (SPPDA)" dir=in action=allow localport=4125 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:648
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - VendorEDI-Port-22 (RetailInsights)" dir=out action=allow remoteip=52.7.164.206 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2496
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - RMSIntegration-Ports-3900,3901,3902" dir=in action=allow localport=3900-3902 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2436
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - RMSEvolutionPOS-Port-8000" dir=in action=allow localport=8000 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:636
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - RMSIntPortal4-Port-8001" dir=in action=allow localport=8001 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3844
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - RMSPOSServices-Port-8002" dir=in action=allow localport=8002 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1824
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - StarPlus-Port-3150 (ASDCProcessor)" dir=in action=allow localport=3150 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4840
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - TherapyManagement-Port-8004" dir=in action=allow localport=8004 protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2652
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - AsPayServer.exe" program="c:\Program Files\Auto-Star\StarPlus\AsPayServer.exe" dir=in action=allow protocol=tcp profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4152
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - WRSA.exe (Webroot AV/AM)" program="C:\Program Files (x86)\Webroot\WRSA.exe" dir=in action=allow profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2948
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - Kaseya-Port-5721 (agent)" dir=out action=allow remoteip=174.36.80.49 protocol=tcp localport=5721 profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2920
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RMSPOS - Kaseya-Port-443 (downloads)" dir=out action=allow remoteip=52.239.154.100 protocol=tcp localport=443 profile=private,domain
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4884