0b01ae83f1f3fb1a719024f9db1eea143bed8b4d43191d5f09d9162dd3184cc0

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
udm.bat
Size 2.6MB
Sample260714-pkbcnact5k
SHA256 0b01ae83f1f3fb1a719024f9db1eea143bed8b4d43191d5f09d9162dd3184cc0
MD5 faa7c59292d14c19f3446c26c08b0a57
SHA1 9116ff526eda404f87a3e4463d9e1bb6ff80cda2
SHA512 900edf293f8195e9acb2c52884bcbf5f2d222cab2eac46c8a5c81b37516cd064c935c5b0f21b0a96de3eaa1ef56efc5b29591f40e5beb8183e354c49d7c88b45
SSDEEP 3072:uCvPB8wO1BAfB+vXvHnWCWZ1orl0GkRx2pkw8DrApBro0i7yC4qu7lOM8lRbndgy:22
TLSH
T1DEC5F96007433E66B2589159C34345A7FDEFA8FD643E6807BBAC74987FE024EE2451B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1636	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1636	powershell.exe
1636	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5816 wrote to memory of 3308	5816	cmd.exe	88
PID 5816 wrote to memory of 1540	5816	cmd.exe	89
PID 5816 wrote to memory of 864	5816	cmd.exe	90
PID 5816 wrote to memory of 4864	5816	cmd.exe	91
PID 5816 wrote to memory of 3644	5816	cmd.exe	92
PID 5816 wrote to memory of 2436	5816	cmd.exe	93
PID 5816 wrote to memory of 5760	5816	cmd.exe	94
PID 5816 wrote to memory of 1252	5816	cmd.exe	95
PID 5816 wrote to memory of 4720	5816	cmd.exe	96
PID 5816 wrote to memory of 1636	5816	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\udm.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Windows\system32\chcp.com
  chcp.com 437
  2⤵
  PID:3308
- C:\Windows\system32\find.exe
  find
  2⤵
  PID:1540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type tmp
  2⤵
  PID:864
- C:\Windows\system32\find.exe
  find
  2⤵
  PID:4864
- C:\Windows\system32\findstr.exe
  findstr /L /I set C:\Users\Admin\AppData\Local\Temp\udm.bat
  2⤵
  PID:3644
- C:\Windows\system32\findstr.exe
  findstr /L /I goto C:\Users\Admin\AppData\Local\Temp\udm.bat
  2⤵
  PID:2436
- C:\Windows\system32\findstr.exe
  findstr /L /I echo C:\Users\Admin\AppData\Local\Temp\udm.bat
  2⤵
  PID:5760
- C:\Windows\system32\findstr.exe
  findstr /L /I pause C:\Users\Admin\AppData\Local\Temp\udm.bat
  2⤵
  PID:1252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type tmp
  2⤵
  PID:4720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -Command "C:\Users\Public\Documemt\python C:\Users\Public\Documemt\Lib\sim.py"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp
Size 14B
SHA256 589c942e748ea16dc86923c4391092707ce22315eb01cb85b0988c6762aa0ed3
MD5 ce585c6ba32ac17652d2345118536f9c
SHA1 be0e41b3690c42e4c0cdb53d53fc544fb46b758d
SHA512 d397eda475d6853ce5cc28887690ddd5f8891be43767cdb666396580687f901fb6f0cc572afa18bde1468a77e8397812009c954f386c8f69cc0678e1253d5752
MD5 SHA1 SHA512

Submit Download

memory/1636-8-0x00000262F9820000-0x00000262F9842000-memory.dmp

Download